cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

JS file not being blocked in an ENABLED (Solidcore Environment)

Hi McAfee Support Team,

We created a JS file (Sample tool) > whne double click it will call the Calc.exe file (to open).

Sample Script:

var jsRun = new ActiveXObject('WSCRIPT.Shell');
jsRun.Run("calc.exe");

 

Then I save it as Calc.js. Making Sure Solidcore status is ENABLED. Running Version 8.3.2.x With McAfee Agent 5.7.x

As soon as I double click it as a normal user (not as administrator). Calculator program opens. Solidcore did not detect that this (JS file) is a foreign file and I am expecting this is EXECUTION DENIED.
But it went run smoothly.

*Making sure, this file is not solidified by running (in command prompt sadmin unso < with the file name>).

Is there a log that I can check what trigger this file to run and not being block by Solidcore ?

6 Replies
AjaySundar
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 7

Re: JS file not being blocked in an ENABLED (Solidcore Environment)

Hi @WillLAus20,

Good day to you!

Can you please confirm if the Solidcore is enabled mode?

Please open the command prompt with admin rights is run the command below:

sadmin status

I created a JS file with the content that you have provided and solidcore is not allowing the execution of the file.

Regards,

Ajay

Re: JS file not being blocked in an ENABLED (Solidcore Environment)

Hi Ajay,

the status is Enabled

PS C:\Windows\system32> sadmin status
McAfee Solidifier: Enabled
McAfee Solidifier on reboot: Enabled

ePO Managed: Yes
Local CLI access: Lockdown

[fstype] [status] [driver status] [volume]
* NTFS Solidified Attached C:\

PS C:\Windows\system32>

Do you know what log file I can check, to see what possible rule (if there are...) that allowing this JS file to run?

Regards, William

 

AjaySundar
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 7

Re: JS file not being blocked in an ENABLED (Solidcore Environment)

Hi @WillLAus20,

Please check the solidcore.log and the S3diag.log under the path below:

C:\ProgramData\McAfee\Solidcore\Logs

Regards,

Ajay

Re: JS file not being blocked in an ENABLED (Solidcore Environment)

was the block that you got, was that a McAfee Access Protection Blocked or McAfee Solidcore Execution denied ?

Re: JS file not being blocked in an ENABLED (Solidcore Environment)

After I wake up the agent (to refresh the logs).

I opened Solidcore.log and S3diag.log and query > anything with calc.js or calc.exe these is the only log/lines.


<PROCESS_CREATED file_name="C:\Windows\System32\calc.exe" pid="87***" process_name="c:\windows\system32\wscript.exe" ppid="38***" parent_process_name="c:\windows\explorer.exe" cksum="c882f09eafddb75843bddbacb796b90195445***" cksum256="a103a57d50b32469c5811e2808f021adf9d9220093b540b8a9c83b5c821d3***" event_time="1632158126***" event_time_system="Sep 20 2021:17:15:26" user_name="***.******.***.***\***qu" workflow_id="NONE" />

Re: JS file not being blocked in an ENABLED (Solidcore Environment)

as per checking, there is a rule when ENABLED "Executing scripts by Windows script host (CScript.exe or Wscript.exe) from common user folders" > Will Prevents the Windows scripting host from running VBScript and JavaScript scripts in any folder with "temp" in the folder name.  If this is not (tick/enable) from McAfee ENS > Access Protection. McAfee Solidcore will not block any "CScript.exe or Wscript.exe" when this is not declare as a BAN File > on the rules solidcore rule hash (of the customized JS file).

Is this correct?

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community