Exploit Prevention Tuning

[msmiley]

We are slowly enabling Exploit Prevention rules by reviewing the Would Block events.  Something I've noticed is that we are seeing Would Block events for files that we have already trusted in TIE.  Does Exploit Prevention not check TIE reputations first?

Example of would block event (Details removed):

Analyzer Rule Name:Malware Behavior: Windows EFS abuse

User ran C:\trustedfile.exe, which accessed C:\ProgramData\Microsoft\directory, violating the rule "Malware Behavior: Windows EFS abuse". Access was allowed because the rule wasn't configured to block.

[Daveb3d]

It does not, because these rules often involve trusted files being exploited for malicious purposes.  You can use the exclusion option at the top of the policy, or in the case of the rules like you mention (any Process, file or registry rule), you can use their code as a baseline and rewrite it to include your own exclusions.  In the case of the one you reference below, I've done exactly that, to both expand coverage beyond the original rule and add my own false positives.

Dave