We are slowly enabling Exploit Prevention rules by reviewing the Would Block events. Something I've noticed is that we are seeing Would Block events for files that we have already trusted in TIE. Does Exploit Prevention not check TIE reputations first?
Example of would block event (Details removed):
Analyzer Rule Name:Malware Behavior: Windows EFS abuse
User ran C:\trustedfile.exe, which accessed C:\ProgramData\Microsoft\directory, violating the rule "Malware Behavior: Windows EFS abuse". Access was allowed because the rule wasn't configured to block.
It does not, because these rules often involve trusted files being exploited for malicious purposes. You can use the exclusion option at the top of the policy, or in the case of the rules like you mention (any Process, file or registry rule), you can use their code as a baseline and rewrite it to include your own exclusions. In the case of the one you reference below, I've done exactly that, to both expand coverage beyond the original rule and add my own false positives.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.