Support Center > Search Results > SecureKnowledge Details
How to update the Threat Emulation malware detection rules Technical Level
Solution

To check the current version of malware detection rules, run the following:

[Expert@HostName:0]# tecli show downloads dr

(You can also run: tecli show downloads dr | sed -n '/Win/{p;n;;n;n;p}'

To update the malware detection rules on Threat Emulation:

  1. Update the malware detection rules and static analysis rules:

    [Expert@HostName:0]# tecli advanced downloads update rules
  2. Delete all records in the Local Cache:

    [Expert@HostName:0]# tecli cache clean

    Note:

    • Until the cache is rebuilt, this will have a negative impact on performance.
    • To remove only specific entries from the cache (e.g., all files with *.swf extension), run:
      tecli cache remove extension <file_extension>

Revision history of malware detection rules:

Date Revision Remarks
26 Aug, 2019 57243 Det Rules update; FP fixes
28 July, 2019 57234 Win10 image DR fixes
21 July, 2019 57233 Win 7 64 bit FN fixes 
17 July, 2019 57232 PDF, XLAM and PPS FPs on all image.
04 July, 2019 57230 XP and 7_64 crash and fake RTF false positive
17 June, 2019 57227 DOCX crash FP on XP + image change adjustments
13 June, 2019 57225 XLAM FPs for win7_64 and Win8
05 June, 2019 57224 PDF file type FP fixes + sandbox agent adjustments
29 May, 2019 57223 black rules for restricting docs activities
23 May, 2019 57222 Sandbox agent changes adjustments
13 March, 2019 57211 Adjusted DR for images emulation agent changes
27 Jan, 2019 57204 Added 'silencing' rules for crash events
14 Jan, 2019 57202/3  Office FPs
7 June 2018
56448  Office FPs
6 June 2018
56445  Office FPs (Cloud Only)
27 May 2018
56444  FP fixes (PDF and Office)
14 May 2018
56443  FP fixes; all images
9 May 2018
56442  Det Rules update; FP fixes
8 May 2018
56441  Det Rules update; FP fixes
3 May 2018
56439  Det rules update
23 Apr 2018
56435  Det rules update. FP fixes (crashes and more)
22 Apr 2018
56434  Det rules update. FP fixes (spooler FPs mostly)
29 Mar 2018
 56433  Det rules update. FP fixes
1 Mar 2018
 56431  Det rules update for all images
31 Jan 2018
 56424  Det rules for the new engine. FN/FP fixes
30 Jan 2018
 56422  Det rules updated for new engine for 4 of the images
29 Jan 2018
 56421  (gradual deployment) Det rules updated for new engine; image w7_2010
23 Jan 2018
 55419/56419  (gradual deployment) Det rules updated for all images
7 Jan 2018
 55415  Det Rules for Win7_2013
4 Jan 2018
 55414  Det Rules for long emulation times
2 Jan 2018
 55413  Det rules for all images
24 Dec 2017
 55410  Det rules for all images
14 Dec 2017
 55309  Det Rules for all images
13 Dec 2017
 55307  Det Rules for all images
12 Dec 2017
 55302  Det rules for XLS, DOC
26 Nov 2017
 55298  Det rules for all images
23 Nov 2017
 55297  Det rules for XP and Win10
22 Nov 2017
 55296  Det rules for Read operations
21 Nov 2017
 55295  Det rules for all images
20 Nov 2017
 55294  PDF FPs for Win8.1
16 Nov 2017
 55293  FPs on all images
14 Nov 2017
 55290  XLS det rules update
13 Nov 2017
 55287  Det rules for all images (PDF, XLSM)
9 Nov 2017
 55283  Det rules for all images (XLS, HWP, PDF)
8 Nov 2017
 55281  Det rules for PDF HWP and XLS files
6 Nov 2017
 55276  Det rules for xlsm file type
5 Nov 2017
 55273  Det rules for XP and 7_64
2 Nov 2017
 55272  Det Rules for file type HWP
1 Nov 2017
 55270  Det rules for Win7_2010 AND Win7_2013
31 Oct 2017
 55269  Det rules for Win7_64 and Win7_2010 AND Win7_2013
31 Oct 2017
 55268  Det rules for Win7_64 and Win7_2010
26 Oct 2017
 55267  Det Rules for Win10
24 Oct 2017
 55262  Det rule changes for all images
22 Oct 2017
 55260  DDE changes related FPs
18 Oct 2017
 55257  Det Rules update for all images
28 Sep 2017
 54246  Det Rules update for win7_32_2013
26 Sep 2017
 54244  Det rules update for Win10
17 Sep 2017
 54243  FPs corrected for XP and Win10
17 Sep 2017
 54242  FPs for all images - daily research
14 Sep 2017
 54241  Fix FPs for Win7_2010 and Win8.1
13 Sep 2017
 54240  Fix FPs for XP and Win7_2013
12 Sep 2017
 54235  Fix FPs for all images
23 Aug 2017
 54225  (Starting from Engine Update 541309) Fix FP for w7_2010
21 Aug 2017
 54224  (Starting from Engine Update 541309) Fix FP for w7_32 and w7_64
17 Aug 2017
 54223
 (Starting from Engine Update 541309) Fix FP for all images
16 Aug 2017
 54222
 (Starting from Engine Update 541309) Fix FP for all images
15 Aug 2017
 54221  (Starting from Engine Update 541309) Fix FP for Win10, Win7_2013 and Win7_64
14 Aug 2017
 54220  (Starting from Engine Update 541309) Fix FP only for Win10
13 Aug 2017
 54218  (Starting from Engine Update 541309) Fix FP only for Win10
10 Aug 2017
 54217  (Starting from Engine Update 541309) Fix FP only for Win10
09 Aug 2017
 54216  (Starting from Engine Update 541309) Fix FP only for Win10

09 Aug 2017

 54215  (Starting from Engine Update 541309) Fix FP all images
08 Aug 2017
 54214  (Starting from Engine Update 541309) Fix FP only for Win10 and in 8.1
08 Aug 2017
 54212  (Starting from Engine Update 541309) Fix FPs for all images
26 July 2017
 54210  (Starting from Engine Update 541309) Fix FP for WinXP W7 W7_2010 W7_2013
25 July 2017
 54209  (Starting from Engine Update 541309) Fix FPs for W10 W7_2013 W7_32 and WinXP
24 July 2017
 54207  (Starting from Engine Update 541309) Fix only for W10 FP
24 July 2017
 54206  (Starting from Engine Update 541309) Fix FP in Win7, WinXP and Win7_2013
20 July 2017
 54150  Fix FP in Win10 and Win7_2013
27 June 2017
 54145  Fix FP in Win10
14 June 2017
 54144  Fix FP in Win10, Win7_2010 and Win7_64
06 June 2017
 54143  Fix FP in WinXP, Win7_2013
31 May 2017
 54142  Fix FP in WinXP, Win10, Win7_2013

Give us Feedback
Please rate this document
[1=Worst,5=Best]
Comment