cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
enxl2
Level 7
Report Inappropriate Content
Message 1 of 3

Why is threat prevention unaware of what changes Microsoft makes in updates?

Jump to solution

Hello,

Over the past couple of months I have become really annoyed with the threat prevention product because it seems to be totally unaware of the fact that Microsoft releases updates for it's products.

For example today I received a bunch of false positives for this "Powershell Command Restriction - Command" when our Exchange server had the audacity to update itself.

Module Name:  Threat Prevention

Analyzer Content Creation Date:              10/20/20 10:19:00 PM EDT

Analyzer Content Version:          10.6.0.10775

Analyzer Rule ID:             6086

Analyzer Rule Name:      Powershell Command Restriction - Command

Source Description:              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command . 'D:\Exchange\\scripts\customization\CustomPatchInstallerActions.ps1' PostPatchInstallActions

Target Hash:      7353f60b1739074eb17c5f4dddefe239

Target Signed:   Yes

Target Signer:    CN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US

Target Parent Process Signed:    Yes

Target Parent Process Signer:     C=US, S=WASHINGTON, L=REDMOND, O=MICROSOFT CORPORATION, CN=MICROSOFT CORPORATION

Target Parent Process Name:      QUIETEXE.EXE

Target Parent Process Hash:       5bf45e9cedd1d9ff0d40e9bb8cc80aab

Target Name:    POWERSHELL.EXE

Target Path:       C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0

Target File Size (Bytes):  448000

Target Modify Time:       9/14/18 11:14:14 PM EDT

Target Access Time:        9/14/18 11:14:14 PM EDT

Target Create Time:        9/14/18 11:14:14 PM EDT

API Name:          AtlComPtrAssign

First Action Status:         Not available

Does McAfee not get a feed from Microsoft that tells the McAfee products what changes to expect during their patching? How do I protect our organization from actual powershell borne threats without getting spammed to death with false positives for routine OS updates?

1 Solution

Accepted Solutions
mpatel127
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: Why is threat prevention unaware of what changes Microsoft makes in updates?

Jump to solution

Hi @enxl2 ,

Thank you for reaching out to McAfee Community for clarification.

The event which are getting generated are expected as per the EP Rule 6086 behavior and we think it's a false positive for your environment. If you want to deal with it, Please follow the solution mentioned by my colleague here on this post  (Kindly refer marked as solution comments.)>>https://community.mcafee.com/t5/Endpoint-Security-ENS/Problem-with-exclusion-for-endpoint-threat-pre... 

Hope this helps!

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

View solution in original post

2 Replies
mpatel127
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: Why is threat prevention unaware of what changes Microsoft makes in updates?

Jump to solution

Hi @enxl2 ,

Thank you for reaching out to McAfee Community for clarification.

The event which are getting generated are expected as per the EP Rule 6086 behavior and we think it's a false positive for your environment. If you want to deal with it, Please follow the solution mentioned by my colleague here on this post  (Kindly refer marked as solution comments.)>>https://community.mcafee.com/t5/Endpoint-Security-ENS/Problem-with-exclusion-for-endpoint-threat-pre... 

Hope this helps!

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

enxl2
Level 7
Report Inappropriate Content
Message 3 of 3

Re: Why is threat prevention unaware of what changes Microsoft makes in updates?

Jump to solution

It's a false positive in every windows 10 environment on the planet Earth.

Thats the problem.

Update your rules.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community