cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
JNedic94
Level 7
Report Inappropriate Content
Message 1 of 4

Exploit Prevention Rules for Prevent Internet Browsing Not Working?

Jump to solution

Hello,

We are attempting to prevent administrative users from being able to browse the internet and/or use an internet browser. We've applied the following Exploit Prevention policies in an attempt to test this:

72840: McAfee Custom - Prevent Internet Browsing with Administrator Account (Firefox)

72841: McAfee Custom - Prevent Internet Browsing with Administrator Account (Chrome, IE, Opera)

70640: McAfee Custom - Prevent Internet Browsing with Microsoft Edge Using Administrator Account

We've tested launching both Firefox and Edge from an account with local administrator privileges and are still able to browse the internet. Is there specific criteria for an "Administrator" account for this policy to properly apply? We're not sure why accounts with administrator privileges are still able to access internet browsers.

1 Solution

Accepted Solutions

Re: Exploit Prevention Rules for Prevent Internet Browsing Not Working?

Jump to solution

This rule will do it

Rule {
	
	Target {
		Match PROCESS {
			Include OBJECT_NAME { 
				-v "msedge.exe"
				-v "chrom.exe"
				-v "firefox.exe"
			}
			Include GROUP_SID { -v "S-1-5-32-544" }
			Include -access "CREATE"
		}
	}
}

View solution in original post

3 Replies
Pravas
Employee
Employee
Report Inappropriate Content
Message 2 of 4

Re: Exploit Prevention Rules for Prevent Internet Browsing Not Working?

Jump to solution

Hi @JNedic94 ,

I'm unable to locate the mentioned signatures in default exploit prevention policy.

Are these custom signatures? If yes, you may need to contact Professional Service for assistance. Please refer the KB below.

https://kcm.trellix.com/agent/index?page=content&id=KB94889

 

Thanks

Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

JNedic94
Level 7
Report Inappropriate Content
Message 3 of 4

Re: Exploit Prevention Rules for Prevent Internet Browsing Not Working?

Jump to solution

Hello @Pravas,

These are not custom from our perspective in the ePO server (they cannot be modified). These may be DISA or DoD custom rules that are integrated into our system. I'll have to verify. Thank you for following up.

Re: Exploit Prevention Rules for Prevent Internet Browsing Not Working?

Jump to solution

This rule will do it

Rule {
	
	Target {
		Match PROCESS {
			Include OBJECT_NAME { 
				-v "msedge.exe"
				-v "chrom.exe"
				-v "firefox.exe"
			}
			Include GROUP_SID { -v "S-1-5-32-544" }
			Include -access "CREATE"
		}
	}
}
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use our Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from product experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by employees.
Join the Community
Join the Community