Exploit Prevention Rules for Prevent Internet Browsing Not Working?

[JNedic94]

Hello,

We are attempting to prevent administrative users from being able to browse the internet and/or use an internet browser. We've applied the following Exploit Prevention policies in an attempt to test this:

72840: McAfee Custom - Prevent Internet Browsing with Administrator Account (Firefox)

72841: McAfee Custom - Prevent Internet Browsing with Administrator Account (Chrome, IE, Opera)

70640: McAfee Custom - Prevent Internet Browsing with Microsoft Edge Using Administrator Account

We've tested launching both Firefox and Edge from an account with local administrator privileges and are still able to browse the internet. Is there specific criteria for an "Administrator" account for this policy to properly apply? We're not sure why accounts with administrator privileges are still able to access internet browsers.

[Pravas]

Hi @JNedic94 ,

I'm unable to locate the mentioned signatures in default exploit prevention policy.

Are these custom signatures? If yes, you may need to contact Professional Service for assistance. Please refer the KB below.

https://kcm.trellix.com/agent/index?page=content&id=KB94889

Thanks

[JNedic94]

Hello @Pravas,

These are not custom from our perspective in the ePO server (they cannot be modified). These may be DISA or DoD custom rules that are integrated into our system. I'll have to verify. Thank you for following up.

[Daveb3d · Accepted solution]

This rule will do it

Rule {
	
	Target {
		Match PROCESS {
			Include OBJECT_NAME { 
				-v "msedge.exe"
				-v "chrom.exe"
				-v "firefox.exe"
			}
			Include GROUP_SID { -v "S-1-5-32-544" }
			Include -access "CREATE"
		}
	}
}