Webex meeting blocked by mcafee

[Dwee]

Hi Team,

i have customer that said they can't open webex invitation meeting over outlook, the outlook just force closed everytime they click accept the webex meeting link, we have already change outlook.exe and webex.exe reputation on TIE to known trusted, and still the result always the same, i noticed theres some rule violated logs :  "C:\Users\USER\AppData\Local\WebEx\WebexHost.exe, which attempted to access the process mfewch.exe, violating the rule "Core Protection - Protect McAfee processes from unauthorized access and termination", and was blocked. For information about how to respond to this event, see KB85494. thats from "Self protection Activity logs"
see file attachment for details, thats the only log file i found about blocking webex,

[Solidcore]

Thanks for raising your concern in the community channel.

Here the scenario is the webexHost.exe during its execution its trying to access the mfewch.exe which is the McAfee process. As you aware no third party application is allowed to access or modify the McAfee process. 

The operation is violating the rule "Core protection - Protect McAfee process from unauthorized access and termination", and hence its restricting accessing the WebexHost.exe.

If you are running the older version ENS, I suggest you to install the latest ENS and test it.

I also verified the Self-protection logs that you shared, i do see there are multiple application execution's is matching to the rule "Core protection - Protect McAfee process from unauthorized access and termination", and getting terminated. 
If the issues arises again after upgrading the ENS version to the very latest, suggest you to add the application exe into the Self protection exclusions under Endpoint Security common exclusions. 

Was my reply helpful?

If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

Thanks and regards,

Ravindra SK

[Pravas]

Hi @Dwee ,

I've seen similar events on my System as well but that doesn't seem to block WebEx in my case.

Please reboot the system and then check again.

Also you may try isolating the module as mentioned in the KB Below.

https://kc.mcafee.com/corporate/index?page=content&id=KB88482

Thanks

[Dwee]

Hi Pravas,

actually it seems this is the side effects of using ATP "security" level of policy that we implemented when we building fresh epo because of the ransomware outbreak, so the false positive and others blocking/contained  behavior been triggered many of it, and i have overload to whitelisted them all/filtering many application, eventhou i'm using TIE reputation, but still we can overrides the reputation of the exes, dll's but it seems different machines/clients different hash file that triggered to TIE, so i'm overwhelmed to exclusion by overrides the reputations, got any ideas pravas? 
no blackbyte triggered this week by the way, 😀

[Dwee]

hi Pravas,

still found webex meeting block by DAC ATP because the reputation unknown, i checked TIE reputation also give this file (GTI rep unknwon), eventhou this is CIsco - webex-llc ? and i have also add webex.exe on exclusion in ATP DAC

[Pravas]

Hi @Dwee,

If you're able to reproduce the issue then please log a support with Ticket for investigation.

Thanks