Hi @Zebu, @sw41, @cheetah, @d00d, @NebulaBilisim,
Firstly Thank you reporting the issue here and actively help us wit the investigation. To clarify our current stance on this issue I would like to submit the below draft.
If you are facing an False positive due to the new Signature introduced exploit prevention content (9845) with the Threat name: Malware Behavior: Windows EFS Abuse,
- Please ensure your Exploit Prevention Content is the latest (9863) an check if you receive the FP alert again
- Please confirm if you entirely trust the application and add it to the exclusion (temporary work around)
- Now Please open a Service Request with us to confirm the validity of the trigger and if an exclusion can be added at the content level.
What does Support do when we report this to them?
Support will raise an issue internally with our Labs team who will validate this reported False positive internally and check if we can add exclusion at content level which will be released subsequently on the next Exploit prevention content release or a future version as applicable until which our exclusion should serve the purpose.
If we still receive the False Positive, what is the use of the newer signature released by McAfee? What have you done in it to mitigate the issue?
Based on our initial analysis and Customer reports we were able to pick up the most critical application identified which can hamper production environment and we added exclusion to the signature. Additionally, we have disabled this rule and lowered it's severity so that it can be enabled by users based on their requirement - just like few other low severity rules we have in place.
I have updated to the latest content 9863 and I can see that the signature is not disabled by default in the policy I have. Why is it so?
This would actually be a nice question though! Answer is straight forward. We do not disable/enable signatures that are of non High severity in any custom policy. Basically the changes of the new content will reflect in the McAfee default policy and if you have a custom policy where this is enabled, you may have to disable it manually if needed.
All other queries and addition of exclusion should be well explained in this KBA:
False positive mitigation for Exploit Prevention signature 6148 for non-standard installation paths
https://kc.mcafee.com/corporate/index?page=content&id=KB92350
I sincerely hope this is of some use to all of you here. Please feel free to ask more questions if you have any with respect to this post!
Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
Thanks and regards,
Adithyan T
You Deserve an Award
