Hi,
I am getting ExpPrev blocks for a specific driver file.
Analyzer Rule ID: 413
Analyzer Rule Name: Suspicious Double File Extension Execution
I understand the rule, however, in this case, it is a legit file and I cannot ask the provider to go and change everything just for me - though I think it is a bat habbit to use dots in a file name.
The description of this rule goes on and says : "To execute legal programs that contain multiple extensions (such as a known file named good_program-1.txt.exe), either rename the file to avoid multiple dots in the file name (for example, good_program-1_txt.exe), or create an exception for this security event so that your trusted file is exempt from triggering this signature."
I cannot rename a driver file, so I have to create an exception in our ePO policy.
I looked into the doc, searche the KB and couldn't find out how I do this.
Can anyone point me to the right doc or help me out ?
Serge
Solved! Go to Solution.
Here's the topic for excluding from Exploit Prevention in 10.6.
Let me know if this isn't what you're looking for.
Hi, I had a look and to me it apears you would have to use the "Files - Proceses - Registry" exclusion type. The reason is based on the events we have in our enviroment its showing that as event description.
You could try creating a new exclusion and put "File Name or Full Path, MD5 Hash and Signer". I think this would be the safest way to limit the false positive you are haivng one file. Keep in mind though it would exclude it from all "File/Process/Registry violation".
Scott
@nik3com If you would like to access the article (ENSTP 10.6 Product Guide), you can also go to our knowledgebase at kc.mcafee.com or support.mcafee.com and search the article name "PD27574". You can also Google this and reach it by searching "PD27574 mcafee", or any variation of the same.
Exploit Prevention exclusions are addressed on page 98.
Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Here's the topic for excluding from Exploit Prevention in 10.6.
Let me know if this isn't what you're looking for.
Hi,
Thank you for your response and for this info - cool, I didn't know there was an on-line doc. 🙂
It is what I was looking for and gives me partial answer, however, it seems incomplete and I have a bad feeling. The page gives info on how to
So, I have a feeling that what I need is not possible...
My present workaround has been to set this rule to log/report only and not block. It is not what I would prefer, but I feel it is the lesser eveil.
Again thanks for your help.
Serge
Hi, I had a look and to me it apears you would have to use the "Files - Proceses - Registry" exclusion type. The reason is based on the events we have in our enviroment its showing that as event description.
You could try creating a new exclusion and put "File Name or Full Path, MD5 Hash and Signer". I think this would be the safest way to limit the false positive you are haivng one file. Keep in mind though it would exclude it from all "File/Process/Registry violation".
Scott
Any news or final judgement on this? I'm having the same issue. Creating exceptions in Exploit Prevention policy does not seem to stop rule 413 from blocking explorer.exe execution of double file extension for the exception file.
Hi @SpecOpsX
Exceptions for Exploit Prevention can only be made for the source process. However in your example adding explorer.exe as an exclusion is not something we would advise.
You can consider creating an expert rule to create an exception for this or otherwise you would need to disbale the rule on that particular machine it is causing you issues. We are considering adding the functionality to add exceptions for target processes in a future build. You can also raise this topic as an IDEA > See KB: https://kc.mcafee.com/corporate/index?page=content&id=KB60021
the link is broken!
@nik3com If you would like to access the article (ENSTP 10.6 Product Guide), you can also go to our knowledgebase at kc.mcafee.com or support.mcafee.com and search the article name "PD27574". You can also Google this and reach it by searching "PD27574 mcafee", or any variation of the same.
Exploit Prevention exclusions are addressed on page 98.
Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Corporate Headquarters
6220 America Center Drive
San Jose, CA 95002 USA