Explanation
TAU-TIN stands for Threat Analysis Unit - Threat Intelligence Notification, which is a series of documents published by the VMware Carbon Black Threat Analysis Unit (TAU) on the VMware Carbon Black community page. These documents provide information about various threats, such as ransomware, malware, and info-stealers, that are detected and prevented by VMware Carbon Black Cloud Endpoint Standard. They also provide recommendations for creating prevention rules based on the observed behavior and indicators of compromise (IOCs) of the threats. For example, the TAU-TIN document for PyCrypter Ransomware1 provides the following prevention rule:
process_name:python.exe AND childproc_name:cmd.exe AND childproc_cmdline:*vssadmin* This rule will prevent any Python process from spawning a command prompt that executes the vssadmin command, which is used by PyCrypter to delete volume shadow copies and prevent data recovery.
Therefore, by referring to the TAU-TIN's on the VMware Carbon Black community page, an administrator can find information about real-world prevention rules that can be used in VMware Carbon Black Cloud Endpoint Standard. References:
Home - Carbon Black Community, Welcome to the VMware Carbon Black User Exchange section.
TAU-TIN - PyCrypter Ransomware - Carbon Black Community, Threat Analysis Unit - Threat Intelligence Notification section.