ATP - Unknown Executable become Known Malicious

[iverbuyst]

Hello,

We currently have our ATP configuration in observation mode and see some executables, which are not signed and provided by an external partners, are marked as "Known Malicious" during RP scanning.

The executables have an Unknown reputation but when they run they launch a cmd.exe with a command and this gets flagged as Known Malicious when we analyse the Story Graph.

What is the best practice in this situation? Just give the executable an Enterprise Reputation or is there a way to prevent the cmd.exe with commands from being malicious?

Kind Regards,

Ivan 

[Pravas]

Hi @iverbuyst ,

When this executable calls CMD.exe it should have some information in Story Graph.

Click on CMD.exe in story graph and verify what its trying to do on right column.

If it connects to a malicious URL for example, then its worth investigating the source file.

You can create a ticket with McAfee Support and submit the Unknown file as a sample.

https://kc.mcafee.com/corporate/index?page=content&id=KB68030

Please also attach the following logs to the ticket mentioning the time stamp of detection.

%deflogdir%\OnAccessScan_Activity.log

%deflogdir%\OnDemandScan_Activity.log

%deflogdir%\ExploitPrevention_Activity.log

%deflogdir%\ExploitPrevention_Debug.log

%deflogdir%\AdaptiveThreatProtection_Activity.log
 

Thanks