Hello,
We are attempting to prevent administrative users from being able to browse the internet and/or use an internet browser. We've applied the following Exploit Prevention policies in an attempt to test this:
72840: McAfee Custom - Prevent Internet Browsing with Administrator Account (Firefox)
72841: McAfee Custom - Prevent Internet Browsing with Administrator Account (Chrome, IE, Opera)
70640: McAfee Custom - Prevent Internet Browsing with Microsoft Edge Using Administrator Account
We've tested launching both Firefox and Edge from an account with local administrator privileges and are still able to browse the internet. Is there specific criteria for an "Administrator" account for this policy to properly apply? We're not sure why accounts with administrator privileges are still able to access internet browsers.
Solved! Go to Solution.
This rule will do it
Rule {
Target {
Match PROCESS {
Include OBJECT_NAME {
-v "msedge.exe"
-v "chrom.exe"
-v "firefox.exe"
}
Include GROUP_SID { -v "S-1-5-32-544" }
Include -access "CREATE"
}
}
}
Hi @JNedic94 ,
I'm unable to locate the mentioned signatures in default exploit prevention policy.
Are these custom signatures? If yes, you may need to contact Professional Service for assistance. Please refer the KB below.
https://kcm.trellix.com/agent/index?page=content&id=KB94889
Thanks
Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
Hello @Pravas,
These are not custom from our perspective in the ePO server (they cannot be modified). These may be DISA or DoD custom rules that are integrated into our system. I'll have to verify. Thank you for following up.
This rule will do it
Rule {
Target {
Match PROCESS {
Include OBJECT_NAME {
-v "msedge.exe"
-v "chrom.exe"
-v "firefox.exe"
}
Include GROUP_SID { -v "S-1-5-32-544" }
Include -access "CREATE"
}
}
}
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.
Thousands of customers use our Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership: