AV solutions are constantly fighting a battle with malware authors to ensure that they detect the latest threats and keep our enterprise networks secure. In some cases it is not always possible for the AV to detect the latest malware strains. Malware authors are constantly updating and refining their code to evade detection and in turn this can lead to infections that we have no idea even exist.Emotet, although not relatively new, is still being in seen in the wild and evading many AV vendors. This malware impacted BT this year and meant we had to put our own proactive procedures in place to detect and remove this malicious software.This presentation will cover the actions undertaken by BT to detect and remove this threat including:• Overview of Emotet Malware – It’s techniques to avoid AV detection and how it harvests outlook credentials to create a targeted spam campaign.• Impact to BT – Large number of spam emails being sent to BT employees seemingly from people they contact via outlook, in turn individuals are unknowingly downloading the malware payloads by opening word documents that are linked in the email. This campaign has impacted employees across the globe in all sectors of the business.• Analysis of malware completed by infecting a physical device - AV wasn’t mitigating the threat so the malware was ran in a controlled environment to see how else we could mitigate the threat.• Open source tools used to gather IOC’s - Wireshark, NetMiner, FakeNet, PE Studio, ProcMon, RegEdit were all used to capture network and host based IOC’s of the malware. A custom PowerShell script was implemented meaning we were able to provide our AV with a list of hashes.• The customised alerting we created on our proxies based on the IOC’s – From our proxy data we were able to identify a network based IOC which was unique enough to create a custom alert on machines infected with Emotet.• Processes we put in place to deal with this as BAU and gather further IOC’s - Dashboard created with list of compromised machines and a process put in place for our 1st line SOC to check devices for known host based IOC’s.• Emotet spambot honeypot implemented – BT Security were able to block the spam from being sent but were able to capture the traffic and attachments. We then used this data to our advantage to keep track of the latest C2’s.• Other threats we found from conducting this piece of work - From implementing the dashboard we also found other strains of malware that displayed similar behaviour to Emotet. A proactive, hunting technique to find other malware was also created off the back of this.