cancel
Showing results for 
Search instead for 
Did you mean: 
SergeM
Level 9
Report Inappropriate Content
Message 1 of 10

How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution

Hi,

I am getting ExpPrev blocks for a specific driver file.

Analyzer Rule ID: 413
Analyzer Rule Name: Suspicious Double File Extension Execution

I understand the rule, however, in this case, it is a legit file and I cannot ask the provider to go and change everything just for me - though I think it is a bat habbit to use dots in a file name.

The description of this rule goes on and says : "To execute legal programs that contain multiple extensions (such as a known file named good_program-1.txt.exe), either rename the file to avoid multiple dots in the file name (for example, good_program-1_txt.exe), or create an exception for this security event so that your trusted file is exempt from triggering this signature."

I cannot rename a driver file, so I have to create an exception in our ePO policy.

I looked into the doc, searche the KB and couldn't find out how I do this.

Can anyone point me to the right doc or help me out ?

Serge

2 Solutions

Accepted Solutions
McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 8 of 10

Re: How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution

@nik3com If you would like to access the article (ENSTP 10.6 Product Guide), you can also go to our knowledgebase at kc.mcafee.com or support.mcafee.com and search the article name "PD27574". You can also Google this and reach it by searching "PD27574 mcafee", or any variation of the same.
Exploit Prevention exclusions are addressed on page 98.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 10 of 10

Re: How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution

Try this one - it works for me:

https://docs.mcafee.com/bundle/endpoint-security-10.5.0-threat-prevention-product-guide-epolicy-orch...

 

Or similarly:

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-product-guide-windows/page...

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
9 Replies
McAfee Employee hannanelson
McAfee Employee
Report Inappropriate Content
Message 2 of 10

Re: How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution

Here's the topic for excluding from Exploit Prevention in 10.6.

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-product-guide-epolicy-orch...

Let me know if this isn't what you're looking for.

SergeM
Level 9
Report Inappropriate Content
Message 3 of 10

Re: How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution

Hi,

Thank you for your response and for this info - cool, I didn't know there was an on-line doc. Smiley Happy

It is what I was looking for and gives me partial answer, however, it seems incomplete and I have a bad feeling. The page gives info on how to

  • "Exclude items from all rules.", which is bad as it goes too far...
  • or I can only "Specify processes for inclusion or exclusion in a user-defined Application Protection rule. (Buffer overflow and illegal API violations only) ", which doesn't help as the rule I'm looking at is "McAfee-defined" rule 413 on double extension on files.

So, I have a feeling that what I need is not possible...

My present workaround has been to set this rule to log/report only and not block. It is not what I would prefer, but I feel it is the lesser eveil.

Again thanks for your help.

Serge

 

 

Tags (3)
youngs
Level 10
Report Inappropriate Content
Message 4 of 10

Re: How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution

Hi, I had a look and to me it apears you would have to use the "Files - Proceses - Registry" exclusion type. The reason is based on the events we have in our enviroment its showing that as event description. 

Exploit.PNG

You could try creating a new exclusion and put "File Name or Full Path, MD5 Hash and Signer".  I think this would be the safest way to limit the false positive you are haivng one file.  Keep in mind though it would exclude it from all "File/Process/Registry violation".  

Scott

 

Re: How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution

Any news or final judgement on this? I'm having the same issue. Creating exceptions in Exploit Prevention policy does not seem to stop rule 413 from blocking explorer.exe execution of double file extension for the exception file.

Highlighted
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 6 of 10

Re: How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution

Hi @SpecOpsX

Exceptions for Exploit Prevention can only be made for the source process. However in your example adding explorer.exe as an exclusion is not something we would advise.

You can consider creating an expert rule to create an exception for this or otherwise you would need to disbale the rule on that particular machine it is causing you issues. We are considering adding the functionality to add exceptions for target processes in a future build. You can also raise this topic as an IDEA > See KB: https://kc.mcafee.com/corporate/index?page=content&id=KB60021

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
nik3com
Level 7
Report Inappropriate Content
Message 7 of 10

Re: How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution

the link is broken!

McAfee Employee jess_arman
McAfee Employee
Report Inappropriate Content
Message 8 of 10

Re: How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution

@nik3com If you would like to access the article (ENSTP 10.6 Product Guide), you can also go to our knowledgebase at kc.mcafee.com or support.mcafee.com and search the article name "PD27574". You can also Google this and reach it by searching "PD27574 mcafee", or any variation of the same.
Exploit Prevention exclusions are addressed on page 98.

 

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

Re: How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution
Link isn't accessible any more. Is there a new place to find this manual?
McAfee Employee chealey
McAfee Employee
Report Inappropriate Content
Message 10 of 10

Re: How to create an exception to an ENS10 ExpPrev rule ?

Jump to solution

Try this one - it works for me:

https://docs.mcafee.com/bundle/endpoint-security-10.5.0-threat-prevention-product-guide-epolicy-orch...

 

Or similarly:

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-product-guide-windows/page...

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?