ATP log powershell

[roberto.periale]

Hi,

from 1 week I get allot of event DAC (event id 37279) due to powershell. for example  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, that tried to access to file C:\Windows\TEMP\__PSScriptPolicyTest_t1xhtzyv.mkh.ps1, trying to violate "Create a fil with extension .bat"

any suggestion?

Thank you

[Daveb3d]

There is a DLL loading into PowerShell causing it to get contained.  Look for that event to see what is causing it.

Dave

[roberto.periale]

Hi,

thank you. I've found this DLL system.ni.dll, but after few day it stopped to log, do you know why?

Thank you

[Daveb3d]

It may have become trusted due to its prevalence. Enabling JTI rule 250 may help with this too.  If it continues to be an issue, exclude the folder where these DLLs exist and use an Access Protection rule to protect the folder so only the true source process for these can write there.

Dave

[Sree26]

Hi @roberto.periale 

Thank you for the query.

Dynamic application containment (DAC) is a rule based feature of ATP. So if a certain transaction is sent over to DAC, it will verify the activity against the preset rules. As per the example you have given here, powershell script is running which in turn here is trying to create another .bat file. Since the rule gets violated due to this action, you see the event.

This rule by default is set to report only which means that you are only notified with an event, however the action is still allowed. You can choose to block this activity too.

Having said this, powershell reputation is lowered when there is a dll injected into it, hence its being put through DAC.