McAfee TIE and ATP Rule Content Update 1701

[mr54]

Hello,

I have a question about ATP rule content update 1701.

Rules 266 and 267 are both updated and have the default state "Evaluate". Both changes refer to rule logic to reduce false positives.

But it is specified "if the administrator turns the rule ON" for rule 267.

What the difference? If I have not turned on rule 267 (so the rule is in evaluate mode), I won't see any detection improvement? But no matter if I changed the 266 rule state or not, there is a detection improvement?

[CharlesS]

c: Initial Access, Execution, Defense Evasion - Techniques: T1566, T1059. It
is uncommon for cmd.exe to be launched via office documents and can be a sign of
malicious behaviour. It's recommended you enable this rule if your workflows allow for it

[yaz]

H9i @mr54 @CharlesS 

Thanks for reaching out to Community. 

This is recommendation from McAfee and hence we request to turn on rule 267 for enhanced security. 

Was my reply helpful?

If yes, kindly give me a Kudo. 

If I have answered your query, kindly mark this as solution so that we help other community members together. 

[Daveb3d]

Evaluate only writes detections to the local log file and I think sends telemetry to McAfee.  Otherwise, it doesn't do you any good unless it is on.

[mr54]

Hello @TALL @yaz @CharlesS, 

Thanks for your replies.

In fact, my question is only about the difference between "changes made to rule logic to reduce false positives" and "changes made to rule logic to reduce false positives, if the administator turns the rule ON" in the case of two rules in evaluate mode.

Thanks

mr

[Saif_f · Accepted solution]

Hi @mr54 ,

Thank you for your post. Rule 267 is enabled (ON) in Security rule group and it is in observe mode in balanced and productivity rule group. Actually even when the rule is in observe mode, it should still have impact in reducing the false positives. 

I think it is just the wording used, as by default when the ATP rule is in observe mode it does not generate any events unless we enable all severity event generation from ENS common policy.

And it is likely mentioned "changes made to rule logic to reduce false positives, if the administrator turns the rule ON", because FP resolve will result in not blocking when rule is ON.

Kind Regards,

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and give a Kudo, together we can help other members.