How to create an exception to an ENS10 ExpPrev rule ?

[Former Member]

Hi,

I am getting ExpPrev blocks for a specific driver file.

Analyzer Rule ID: 413
Analyzer Rule Name: Suspicious Double File Extension Execution

I understand the rule, however, in this case, it is a legit file and I cannot ask the provider to go and change everything just for me - though I think it is a bat habbit to use dots in a file name.

The description of this rule goes on and says : "To execute legal programs that contain multiple extensions (such as a known file named good_program-1.txt.exe), either rename the file to avoid multiple dots in the file name (for example, good_program-1_txt.exe), or create an exception for this security event so that your trusted file is exempt from triggering this signature."

I cannot rename a driver file, so I have to create an exception in our ePO policy.

I looked into the doc, searche the KB and couldn't find out how I do this.

Can anyone point me to the right doc or help me out ?

Serge

[Former Member · Accepted solution]

Here's the topic for excluding from Exploit Prevention in 10.6.

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-product-guide-epolicy-orch...

Let me know if this isn't what you're looking for.

[Former Member]

Hi,

Thank you for your response and for this info - cool, I didn't know there was an on-line doc. 🙂

It is what I was looking for and gives me partial answer, however, it seems incomplete and I have a bad feeling. The page gives info on how to

• "Exclude items from all rules.", which is bad as it goes too far...
• or I can only "Specify processes for inclusion or exclusion in a user-defined Application Protection rule. (Buffer overflow and illegal API violations only) ", which doesn't help as the rule I'm looking at is "McAfee-defined" rule 413 on double extension on files.

So, I have a feeling that what I need is not possible...

My present workaround has been to set this rule to log/report only and not block. It is not what I would prefer, but I feel it is the lesser eveil.

Again thanks for your help.

Serge

[youngs · Accepted solution]

Hi, I had a look and to me it apears you would have to use the "Files - Proceses - Registry" exclusion type. The reason is based on the events we have in our enviroment its showing that as event description. 

You could try creating a new exclusion and put "File Name or Full Path, MD5 Hash and Signer".  I think this would be the safest way to limit the false positive you are haivng one file.  Keep in mind though it would exclude it from all "File/Process/Registry violation".  

Scott

[SpecOpsX]

Any news or final judgement on this? I'm having the same issue. Creating exceptions in Exploit Prevention policy does not seem to stop rule 413 from blocking explorer.exe execution of double file extension for the exception file.

[Former Member]

Hi @SpecOpsX

Exceptions for Exploit Prevention can only be made for the source process. However in your example adding explorer.exe as an exclusion is not something we would advise.

You can consider creating an expert rule to create an exception for this or otherwise you would need to disbale the rule on that particular machine it is causing you issues. We are considering adding the functionality to add exceptions for target processes in a future build. You can also raise this topic as an IDEA > See KB: https://kc.mcafee.com/corporate/index?page=content&id=KB60021

[nik3com]

the link is broken!

[jess_arman · Accepted solution]

@nik3com If you would like to access the article (ENSTP 10.6 Product Guide), you can also go to our knowledgebase at kc.mcafee.com or support.mcafee.com and search the article name "PD27574". You can also Google this and reach it by searching "PD27574 mcafee", or any variation of the same.
Exploit Prevention exclusions are addressed on page 98.

Was my reply helpful?

If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[Former Member]

Link isn't accessible any more. Is there a new place to find this manual?

[Former Member · Accepted solution]

Try this one - it works for me:

https://docs.mcafee.com/bundle/endpoint-security-10.5.0-threat-prevention-product-guide-epolicy-orch...

Or similarly:

https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-product-guide-windows/page...