ATP/Suspect!dd399 ae46303 alerts

[Thyssenkrupp]

ATP/Suspect!dd399 ae46303 alerts
I am getting ATP/Suspect!dd399 ae46303 alerts for rundll32.exe on a few WVD machines in my environment. The file seems to be clean, but it appears like maybe someone or something is trying to use the file for nefarious purposes (or this is just a false positive). Can someone shed some light on this please? thank you!

Description: The reputation of the rundll32.exe application is Might be Malicious, which is below the configured containment threshold. Adaptive Threat Protection didn't contain the application because Observe mode is enabled. Duration Before Detection (Days): >7 days Attack Vector Type: Local System Adaptive Threat Protection Events Certificate Name: No Certificate Certificate Hash: None Content Version: Not Available Detection Type: On-Execute Scan File Company Creator: Microsoft Corporation File SHA1 Hash: dd399ae46303343f9f0da189aee11c67bd868222 File MD5 Hash: ef3179d498793bf4234f708d3be28633 File Type: Executable Reputation: Might be Malicious Balance Security For: Balanced Real Protect Scanning - Sensitivity level: Medium Rule Name: Identify target process launching non standard extensions or launched by non-standard actor Rule Description: Mitre-T1036, T1059: Attempts to prevent processes trying to launch non-standard extensions or being launched by non-standard actor Rule Detailed Description: Tactics: Execution, Defense Evasion - Techniques: T1036, T1059. Detects target process launching non standard extensions like CScript is launching a txt file

[yaz]

Hi @Thyssenkrupp 

Thank you for reaching out to Community. 

From the provided description, I understand you are looking for information on the detection details. 

From ATP options policy, if observe mode is enabled, then we see this issue. 

"The reputation of the rundll32.exe application is Might be Malicious, which is below the configured containment threshold. Adaptive Threat Protection didn't contain the application because Observe mode is enabled."

The mentioned MD5 hash ef3179d498793bf4234f708d3be28633 seems to be clean from our database records. 

I suggest you to test by disabling the Observe mode and test. 

Was my reply helpful?

If yes, please give me a Kudo. If I have answered your query, Kindly mark this as solution so that together we help other community members. 

[Thyssenkrupp]

Hi, are you suggesting that we turn this off or set it to block? I am concerned that either we do not have ENS configured properly for the WVD environment or it is not compatible with the WVD environment.  https://kc.mcafee.com/corporate/index?page=content&id=KB94364

thank you for any help you can provide!

[harshgautam]

Hi @Thyssenkrupp ,

Thank you for reaching out to us on McAfee Community.

Rule 266: Identify target process launching non-standard extensions or launched by non-standard actor

We have seen a few false positives being reported for Rule 266

Rule 266: Identify target process launching non-standard extensions or launched by non-standard actor
Description: Attempts to prevent processes trying to launch non-standard extensions or being launched by non-standard actor. For instance, CScript is launching a txt file (Tactics: Execution, Defense Evasion - Techniques: T1036, T1059)
Default State: Evaluate

Problem:
It has been observed that anything after.dll followed by , is also considered as an extension

example: Target command line: rundll32.exe C:\WINDOWS\system32\davclnt.dll,DavSetCookie

here "dll,davsetcookie" this whole string is considered as extension and hence the rule 266 is triggered.

The above can be found in ATP debug logging.

Solution, Kindly update to the latest ATP content and the issue will be resolved.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[Thyssenkrupp]

This is extremely helpful, thank you. Can you please tell me how to update to the latest ATP content please? thank you again!

[Thyssenkrupp]

Can you please tell me how to update to the latest ATP content please?

[yaz · Accepted solution]

HI @Thyssenkrupp 

Rules and content update are automatic. 

There is no further actions needed from your end.

https://www.mcafee.com/enterprise/en-in/release-notes/threat-intelligence-exchange.html

Was my reply helpful?

If yes, please give me a kudo. If I have answered your query, kindly mark this as solution so that we help other community members together.