Exceptions in exploit-protection does not take effect

[sasu]

Hi @ all,

I need to provide exceptions in the threat prevention of ENS10.5.4 managed by ePO 5.9.1 but the added item in the exploit-protection policy does not take effect.

In my case I need an exception for exploit-protection ID 413 "Suspicious Double File Extension Execution". As soon as I disable this option, I can execute my test file with multiple points in the filename.

In our "My Default" policy of "Endpoint Security Threat Prevention" I configured in the area "Exceptions" the test exception as follow:
Name: EXPLORER:EXE - as like as the name is written in the log files of the client
Filename: test.tmp.cmd - also as written in the log file

After saving an pushing this policy to my test client I test it - but it does not work. Why? Any ideas?

Furthermore - is it possible to configure a network path as exception? For example \\domain\netlog?

Best regards,
Sascha

[aguevara]

Hi sasu

Here it will be better if you could please open a case with support, we need to take a look at one of the affected systems with a debugged MER (KB82170) and see why the policy enforcement is not working

[sasu]

Hi Aguevara,

thanks a lot for your help!
I opened a ticket. During I was waiting for a response from the support the server executes the policies – so I closed the ticket. A little bit strange.

Do you know if there is a bug with “force policy” in the agent event monitor or by pushing the policies by “agent reactivation” with “force policies” from ePO 5.9.1?

It seems to be a question of time. If I have to wait for any automatically processes.



Regards,
Sascha

[cdinet]

What was your case number?  I can take a look.

[sasu]

Hey cdinet,

case number was: 4-19029346841

Thanks in advance