cancel
Showing results for 
Search instead for 
Did you mean: 
ta11
Level 9
Report Inappropriate Content
Message 1 of 3

Exploit prevention rule exception question

This is regarding configuring ENS exploit prevention rules. In our company we are blocking Powershell -EncodedCommand exploit prevention rule (6087) detection. But couple of systems still need to run such powershell commands. My first thought was that we can sign the Powershell script with internal signer (CA) and do exception for such signed scripts by trusting signer. Checking closer the rule and exception possibilities, seems it is not possible with current ENS (10.6.1. Do you confirm? What other choices we have?
2 Replies
McAfee Employee tzemva
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: Exploit prevention rule exception question

Hi @ta11,

There is a known issue in currently available versions of ENS 10.6.1 where Exploit Prevention exclusions are not working properly with signer details. This issue will be addressed in upcoming ENS 10.6.1 December Update. I recommend you wait for mentioned release and test your EP Exclusion again. 

ta11
Level 9
Report Inappropriate Content
Message 3 of 3

Re: Exploit prevention rule exception question

Thank you.

The issue I'm describing is not related to the bug as I see, but with the capability of the product to fulfill specific use case. I can see exploit prevention policy exclusions section tool allows to create exceptions based on process name and signer and by caller module name and signer. In this rule case, process is powershell.exe and there is no caller module. So signing our internal scripts in order to trust those and exclude from exploit prevention rules triggers is not capability of current product. Or I miss something?   

Member Rewards
McAfee Community rewards active and helpful members just like you. Click here to take a look at the first community members who received a special reward and were recognized by McAfee leader, Aneel Jaeel, for their participation and trusted knowledge in the community.