How can I make exclusion to PDQInventory-Scanner?

[ssedhai]

I have lots of events saying NT AUTHORITY\SYSTEM ran SYSTEM:REMOTE\SYSTEM:REMOTE, which accessed C:\Windows\AdminArsenal\PDQInventory-Scanner\service-1\\ , violating the rule "Remotely accessing local files or folders". Access was allowed because the rule wasn't configured to block. How can make a exclusion so that this event can be ignored? 

I have made a exclusion for this one this seems not working at this point. 

NT AUTHORITY\SYSTEM ran SYSTEM:REMOTE\SYSTEM:REMOTE, which accessed C:\Windows\AdminArsenal\PDQInventory-Scanner\service-1\\ , violating the rule "Remotely accessing local files or folders". Access was allowed because the rule wasn't configured to block.

---

Analyzer / Detector
Analyzer content creation date	9/22/2015 6:11 AM
Analyzer content version	10.6.0
Product name	McAfee Endpoint Security
Analyzer rule name	Remotely accessing local files or folders
Product version	10.6.1
Feature name	Access Protection
Threat
Action taken	Would Block
Threat category	'File' class or access
Threat event ID	1095
Threat handled	Yes
Threat name	Remotely accessing local files or folders
Threat severity	Critical
Threat timestamp	2/7/2020 12:35 PM
Threat type	Access Protection
Source
Source file path	SYSTEM:REMOTE
Source IPV4	10.10.6.182
Source process name	SYSTEM:REMOTE
Source process signed	No
Source user name	NT AUTHORITY\SYSTEM
Target
Target host name	computername
Target name
Target path	C:\Windows\AdminArsenal\PDQInventory-Scanner\service-1\
Target signed	No
Target user name	SYSTEM
Other
Access requested	Delete
Vector type	File Share

This table is taken out from ENS event window. 

Trellix Endpoint Security 

[Kenchee_etf · Accepted solution]

Hello @ssedhai 

The rule you are using, "Remotely accessing local files or folders" is very aggressive rule and it is disabled by Default.

Purpose of the rule can be found in:

*** McAfee Endpoint Security 10.6.0 - Threat Prevention Product Guide - Windows
https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-product-guide-windows/page...

section "McAfee-defined Access Protection rules" where you have:

McAfee-defined rule: Remotely accessing local files or folders
Description: Prevents read and write access from remote computers to the computer. In a typical environment, this rule is suitable for workstations, but not servers.
Default setting: empty (aka not set to block or report)
Benefits: Prevents a share-hopping worm from spreading.
Risks: Prevents updates or patches from being installed to systems managed by pushing files. This rule doesn't affect the management functions of McAfee ePO.

TIP: Best practice Enable this rule only when computers are actively under attack.

Now, majority of remote access scenarios will have "Source file path -> SYSTEM:REMOTE", because the software PDQInventory-Scanner is using it to access to machine and that is what OS sees, (not PDQInventory-Scanner) hence you can't exclude PDQInventory-Scanner from the rule.

Also there is lot of scenarios where with same situation where in product guide is mentioned update, you should also see SYSTEM:REMOTE if you try to access to c$, but also Malware may use it as well hence in order for you to make exclusion you have to exclude whole "SYSTEM:REMOTE" which would defeat the purpose of rule itself.

The conclusion and best suggestion is to actually follow the best practice for the rule given in product guide itself.

I hope, I explained myself properly.

[ssedhai]

@Kenchee_etf 

Thanks for the response. These events are not bothering but I just I wanted to reduce the number of events so that I can focus only on the important ones. 

I can keep as it is. 

Cheers!