JS file not being blocked in an ENABLED (Solidcore Environment)

[WillLAus20]

Hi McAfee Support Team,

We created a JS file (Sample tool) > whne double click it will call the Calc.exe file (to open).

Sample Script:

var jsRun = new ActiveXObject('WSCRIPT.Shell');
jsRun.Run("calc.exe");

Then I save it as Calc.js. Making Sure Solidcore status is ENABLED. Running Version 8.3.2.x With McAfee Agent 5.7.x

As soon as I double click it as a normal user (not as administrator). Calculator program opens. Solidcore did not detect that this (JS file) is a foreign file and I am expecting this is EXECUTION DENIED.
But it went run smoothly.

*Making sure, this file is not solidified by running (in command prompt sadmin unso < with the file name>).

Is there a log that I can check what trigger this file to run and not being block by Solidcore ?

[AjaySundar]

Hi @WillLAus20,

Good day to you!

Can you please confirm if the Solidcore is enabled mode?

Please open the command prompt with admin rights is run the command below:

sadmin status

I created a JS file with the content that you have provided and solidcore is not allowing the execution of the file.

Regards,

Ajay

[WillLAus20]

Hi Ajay,

the status is Enabled

PS C:\Windows\system32> sadmin status
McAfee Solidifier: Enabled
McAfee Solidifier on reboot: Enabled

ePO Managed: Yes
Local CLI access: Lockdown

[fstype] [status] [driver status] [volume]
* NTFS Solidified Attached C:\

PS C:\Windows\system32>

Do you know what log file I can check, to see what possible rule (if there are...) that allowing this JS file to run?

Regards, William

[AjaySundar]

Hi @WillLAus20,

Please check the solidcore.log and the S3diag.log under the path below:

C:\ProgramData\McAfee\Solidcore\Logs

Regards,

Ajay

[WillLAus20]

was the block that you got, was that a McAfee Access Protection Blocked or McAfee Solidcore Execution denied ?

[WillLAus20]

After I wake up the agent (to refresh the logs).

I opened Solidcore.log and S3diag.log and query > anything with calc.js or calc.exe these is the only log/lines.


<PROCESS_CREATED file_name="C:\Windows\System32\calc.exe" pid="87***" process_name="c:\windows\system32\wscript.exe" ppid="38***" parent_process_name="c:\windows\explorer.exe" cksum="c882f09eafddb75843bddbacb796b90195445***" cksum256="a103a57d50b32469c5811e2808f021adf9d9220093b540b8a9c83b5c821d3***" event_time="1632158126***" event_time_system="Sep 20 2021:17:15:26" user_name="***.******.***.***\***qu" workflow_id="NONE" />

[WillLAus20]

as per checking, there is a rule when ENABLED "Executing scripts by Windows script host (CScript.exe or Wscript.exe) from common user folders" > Will Prevents the Windows scripting host from running VBScript and JavaScript scripts in any folder with "temp" in the folder name.  If this is not (tick/enable) from McAfee ENS > Access Protection. McAfee Solidcore will not block any "CScript.exe or Wscript.exe" when this is not declare as a BAN File > on the rules solidcore rule hash (of the customized JS file).

Is this correct?