Help Creating an Expert Rule to exclude Vendor Double File Extentions

[User27605043]

I would like help creating an Expert rule exception for these files. GetPendingUpdates.vbs.CMD GetUpdateDates.vbs.CMD

[User27605043]

Here is what I see in ePO:

Threat Target File Path: C:\Users\userid\AppData\Local\Temp\5aed1862-b14e-478a-855f-1116538612c4\GetPendingUpdates.vbs.CMD
Event Category: 'File' class or access
Event ID: 18060
Threat Severity: Critical
Threat Name: Suspicious Double File Extension Execution
Threat Type: Exploit Prevention
Action Taken: Blocked
Threat Handled: True
Analyzer Detection Method: Exploit Prevention

[Pravas]

Hi @User27605043 ,

We can exclude the Source Process in Exploit Prevention policy to avoid the detection.

However, please do not exclude any well-known windows process like Explorer.exe, CMD.exe etc.

Alternatively, the signature can be turned off for target systems.

Incase you're looking for a custom signature, please reach out to Professional Services.

https://www.mcafee.com/enterprise/en-in/services/solution-services.html

Thanks

[User27605043]

Should this case be opened against ePO or against ENS? ENS rules but in ePO. Which should be selected when opening the case?

[Daveb3d]

I'll DM you an Expert Rule that includes the McAfee rule content but your exclusion.

Dave

[User27605043]

Great!

[Pravas · Accepted solution]

Hi @User27605043 ,

You may open a Service Request with ENS Support.

We may be able to help with the Signature ID 413.

Thanks

[ChrisQ]

I'm really interested in seeing an expert rule for excluding some double file extension detections please.

For example:
C:\ProgramData\Zebra Technologies\CardStudio2\updates\CardStudio 2.5.4\CardStudio-Setup_2.5.4.exe, which tried to access the file C:\Users\Personaldata.removed\AppData\Local\Temp\EXECDEF.tmp.bat, violating the rule "Suspicious Double File Extension Execution", and was blocked.

[User27605043 · Accepted solution]

Here is what support told me.

1. Turn off the McAfee Double File Extention Rule 

The rule is in the Policy "Endpoint Seucirty Threat Prevention > Exploit Prevention

In the My Default, navigate to Signatures and search for 413 and uncheck the rule.

Save it.

2. Add an expert rule (button in Signatures.

Name the new rule.

Select Severity High

Block and report for Actions

Rule type Processes

Copy this in the box and change the Placeholder files "Filename.extention" to yours. 

I am not 100% sure the formatting is saved in this communication correctly. But here you go.

Rule {
	set os_major_version [iSystem major]
	set os_arch [iSystem os_arch]
	if { $os_arch == 320 } {
		set WOW64_HKLM_ProgramFiles_32 [iReg value "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion" ProgramFilesDir]
		set WOW64_HKLM_ProgramFiles_64 [iReg value "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion" ProgramFilesDir]
	} else {
		set WOW64_HKLM_ProgramFiles_32 [iReg value "HKLM\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion" ProgramFilesDir]
		set WOW64_HKLM_ProgramFiles_64 [iReg value "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion" ProgramFilesDir]
	}
	
	Target {
		Match FILE {
			Include OBJECT_NAME {
				-v *.???.bat
				-v *.???*.cmd
				-v *.???*.pif
				-v *.???.com
				-v *.avi*.exe
				-v *.bmp*.exe
				-v *.com.exe
				-v *.com???.exe
				-v *.doc.exe
				-v *.doc???.exe
				-v *.gif*.exe
				-v *.htm*.exe
				-v *.jpeg*.exe
				-v *.jpg*.exe
				-v *.mov*.exe
				-v *.mp3*.exe
				-v *.pdf*.exe
				-v *.ppt*.exe
				-v *.rtf*.exe
				-v *.txt*.exe
				-v *.wmv*.exe
				-v *.xls*.exe
				-v *.avi*.com
				-v *.bmp*.com
				-v *.doc*.com
				-v *.gif*.com
				-v *.htm*.com
				-v *.jpeg*.com
				-v *.jpg*.com
				-v *.mov*.com
				-v *.mp3*.com
				-v *.pdf*.com
				-v *.ppt*.com
				-v *.rtf*.com
				-v *.txt*.com
				-v *.wmv*.com
				-v *.xls*.com
				-v *.avi*.bat
				-v *.bmp*.bat
				-v *.doc*.bat
				-v *.gif*.bat
				-v *.htm*.bat
				-v *.jpeg*.bat
				-v *.jpg*.bat
				-v *.mov*.bat
				-v *.mp3*.bat
				-v *.pdf*.bat
				-v *.ppt*.bat
				-v *.rtf*.bat
				-v *.txt*.bat
				-v *.wmv*.bat
				-v *.xls*.bat
				-v *.avi*.scr
				-v *.bmp*.scr
				-v *.com.scr
				-v *.com???.scr
				-v *.doc*.scr
				-v *.gif*.scr
				-v *.jpeg*.scr
				-v *.htm*.scr
				-v *.jpg*.scr
				-v *.mov*.scr
				-v *.mp3*.scr
				-v *.pdf*.scr
				-v *.ppt*.scr
				-v *.rtf*.scr
				-v *.txt*.scr
				-v *.wmv*.scr
				-v *.xls*.scr
		}
		Exclude OBJECT_NAME {
			-v $WOW64_HKLM_ProgramFiles_32\\**
			-v *\\*.com*\\*.exe
			-v *\\*.data*\\*.com
			-v *\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\*\\*.com
			if { $os_arch == 640 } { 
				-v $WOW64_HKLM_ProgramFiles_64\\**													
			}
			-v C:\\Filename.extention
			-v C:\\Filename.extention
			
		}
		Include -file_attributes "!ARCHIVE"
		Include -access "EXECUTE"
		}
	}
}

[Daveb3d]

There are some gaps in this rule, and I also question its efficiency, as I really examine it (which oddly, though I've worked on the rule in the past, I never sat down to actually consider).

The *.ext*.ext can't be very efficient and reminds me of an issue I recently came across related to AAC performance with an APR. I would think most of these can simply be *.ext.ext.  The exception is Office related extensions. So in that case, we would need both *.doc.ext and *.doc?.ext.  Also missing are *.xls.bat, *.xls?.bat and a few other, similar ones.  I also wonder if script files should be included, as well as .hta and, especially, .lnk.

So these might just be a simple: -v "*.???.lnk" and -v "*.????.lnk", etc.  

Open to disagreements and thoughts about removing the middle * in the various ones.

Dave