Exclusion for Powershell alert from COMPATTELRUNNER.EXE

[JadedbyMcafee]

How do I exclude COMPATTELRUNNER.EXE from this type of alert 

We have turned telemetry down to 0 on Windows 10 Enterprise

Threat Target Process Name:Threat Target File Path:Event Category:Event ID:Threat Severity:Threat Name:Threat Type:Action Taken:Threat Handled:Analyzer Detection Method:

POWERSHELL.EXE

C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE

Host intrusion buffer overflow

18054

Critical

ExP:Illegal API Use

Exploit Prevention

Blocked

True

Exploit Prevention

Events received from managed systems 

Event Description:

An exploit was attempted and blocked

Endpoint Security 

Module Name:Analyzer Content Creation Date:Analyzer Content Version:Analyzer Rule ID:Analyzer Rule Name:Source Description:Target Hash:Target Signed:Target Signer:Target Parent Process Signed:Target Parent Process Name:Target Parent Process Hash:Target Name:Target Path:Target File Size (Bytes):Target Modify Time:Target Access Time:Target Create Time:API Name:First Action Status:Second Action Status:Description:Attack Vector Type:

Threat Prevention

11/6/20 3:54:40 AM GMT

10.6.0.10858

6086

Powershell Command Restriction - Command

powershell.exe -ExecutionPolicy Restricted -Command Write-Host 'Final result: 1';

cda48fc75952ad12d99e526d0b6bf70a

Yes

CN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US

No

COMPATTELRUNNER.EXE

339de473e8bd33b6a31c264285efc034

POWERSHELL.EXE

C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0

451584

3/19/19 4:46:56 AM GMT

3/19/19 4:46:56 AM GMT

3/19/19 4:46:56 AM GMT

AtlComPtrAssign

Not available

Not available

ExP:Illegal API Use Blocked an attempt to exploit C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE, which targeted the AtlComPtrAssign API.

Local System

[hitesh_Reddy · Accepted solution]

Hello Jadedby,

Thank you for writing, From the details shared, We are looking at the exploit prevent rule "6087 - Host intrusion buffer overflow" being violated.

Unfortunately, the event formed seems to be choppy, and could not exactly figure the details.

If we are looking at Target Parent Process Name: being "COMPATTELRUNNER.EXE", Please try the below exclusion and test it on 1 machine and see if that helps 

ENS Exploit Prevention policy:

Exclusion Type: illegal API Use
Process: POWERSHELL.EXE
Caller: COMPATTELRUNNER.EXE
API: AtlComPtrAssign

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a solution" if this reply resolves your query!

Hitesh

[JadedbyMcafee]

ok done .. I'll see in the morning .. thanks

Process Name

Caller Module Name

API Name

Signatures IDs

Service Name

IP Addresses

Actions

	Illegal API Use - Buffer Overflow	POWERSHELL.EXE	COMPATTELRUNNER.EXE	AtlComPtrAssign				Edit | Duplicate

[JadedbyMcafee]

perfect thanks