Showing results for 
Search instead for 
Did you mean: 
Level 9
Report Inappropriate Content
Message 1 of 3

Exploit prevention rule exception question

This is regarding configuring ENS exploit prevention rules. In our company we are blocking Powershell -EncodedCommand exploit prevention rule (6087) detection. But couple of systems still need to run such powershell commands. My first thought was that we can sign the Powershell script with internal signer (CA) and do exception for such signed scripts by trusting signer. Checking closer the rule and exception possibilities, seems it is not possible with current ENS (10.6.1. Do you confirm? What other choices we have?
2 Replies
McAfee Employee tzemva
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: Exploit prevention rule exception question

Hi @ta11,

There is a known issue in currently available versions of ENS 10.6.1 where Exploit Prevention exclusions are not working properly with signer details. This issue will be addressed in upcoming ENS 10.6.1 December Update. I recommend you wait for mentioned release and test your EP Exclusion again. 

Level 9
Report Inappropriate Content
Message 3 of 3

Re: Exploit prevention rule exception question

Thank you.

The issue I'm describing is not related to the bug as I see, but with the capability of the product to fulfill specific use case. I can see exploit prevention policy exclusions section tool allows to create exceptions based on process name and signer and by caller module name and signer. In this rule case, process is powershell.exe and there is no caller module. So signing our internal scripts in order to trust those and exclude from exploit prevention rules triggers is not capability of current product. Or I miss something?   

More McAfee Tools to Help You
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • Visit: Business Service Portal
  • More: Search Knowledge Articles
  • ePolicy Orchestrator Support
  • The McAfee ePO Support Center Plug-in is now available in the Software Manager. Follow the instructions in the Product Guide for more.