Use Symantec Endpoint Protection to run the YARA rules to scan Linux servers for CVE-2024-3094

Use SEP to run the YARA rules to scan Linux servers for CVE-2024-3094

https://techdocs.broadcom.com/us/en/symantec-security-software/endpoint-security-and-management/endpoint-protection/all/Using-policies-to-manage-security/preventing-and-handling-virus-and-spyware-attacks-v40739565-d49e172/scanning-the-SEP-client-computer-using-custom-YARA-rules.html

Yara rule for CVE-2024-3094

https://github.com/Neo23x0/signature-base/blob/master/yara/bkdr_xz_util_cve_2024_3094.yar

Reference:

https://www.kaspersky.com/blog/cve-2024-3094-vulnerability-backdoor/50873/

Use Symantec Endpoint Protection to run the YARA rules to scan Linux servers for CVE-2024-3094

Broadcom (Symantec) SEP 14.3 RU6 bug cause Linux hang up

Error log: sisap_uc_uevent: fp was DELETED xxxxxxxxxxxxxxxxx, pid xxxx, fid xxxxxx leaving with ret=1, waiting=63, nsq=0, wait_scan=54, filename=noname 

Issue: After upgrading the Endpoint Protection client to 14.3 RU6 (14.3.2509.6000), Linux machines running the agent may get into a hung state. In the /var/log/messages file, you will see the following types of error messages: sisap_uc_uevent: fp was DELETED 

Affected and matched to our current running SEP version: Symantec Endpoint Protection (SEPM) 14.3.2509.6000 

Resolution: Upgrade the agent to the latest version (14.3.2529.6000 or later). 

Reference: Linux servers hang after upgrading to SEP 14.3 RU6 (broadcom.com)

If you plan to upgrade to 14.3 RU8 to resolve this issue.
Before you upgrade to 14.3 RU8, 
 you need to check the Kernel version is it on support list. 
 https://linux-repo.us.securitycloud.symantec.com/SAL/1.3/seplinux_supported_kernels.html  
 After the upgrade, you should to follow the following steps to check: 
 (A scheduled downtime is required)

Symantec_SEP_(DC_2.0).pdf (hicloud.net.tw)

https://s3.hicloud.net.tw/ndc/ndc_form/Symantec_SEP_%E5%AE%89%E8%A3%9D%E6%A8%99%E6%BA%96%E4%BD%9C%E6%A5%AD%E7%A8%8B%E5%BA%8F%E6%9B%B8(DC_2.0).pdf

Broadcom (Symantec) SEP 14.3 RU6 bug cause Linux hang up

Symantec Endpoint Protection (SEP) being restarted automatically on Linux

If you run the following command to stop and disable the SEP:

systemctl stop sisamddaemon

systemctl disable sisamddaemon

The SEP will restart itself later.

For SEP Linux agent version 14.3 RU1 and above, you can stop the SEP Linux agent using the ./stop.sh command in /usr/lib/symantec folder.

However, as per product design, stopping SEP Linux agent is not permanent. Services will be resumed if the Linux machine is restarted.

If you ./stop.sh without reboot. The SEP Linux services will remain fully stop until it is startup using ./start.sh command or on the next system reboot.

The only way to permanently stop the SEP service is uninstall it or temporary ./stop.sh without reboot the system.

How to restart the Endpoint Protection Linux daemons

https://knowledge.broadcom.com/external/article/151271/how-to-restart-the-endpoint-protection-l.html

Symantec Endpoint Protection (SEP) being restarted automatically on Linux

Endpoint Protection (AntiVirus) Forum

http://www.symantec.com/connect/security/forums/endpoint-protection

Endpoint Protection (AntiVirus) Forum