With the release of the Trellix agent for Windows 5.7.8 I have recreating deployments for new computer installs. This issue is on newly imaged machines that have no previous McAfee or Trellix products. After the Trellix agent is installed and it checks in with EPO I have a "Product Deployment" configured to push out "Endpoint Security" (I have duplicated the issue with version 10.6.1 and 10.7). The deployment seems to complete successfully but it is triggering an "Access Protection rule violation" every single time. The program still appears to work and I am able to install other components of Endpoint security such as Adaptive Threat Protection, and Threat Prevention but I'm unsure if I'm doing something wrong because of the error. Does anyone know if this is a known issue, or if there is a fix?
The error I receive is as follows:
Threat Category: 'Process' class or access
Threat Type: Self Protection
Threat Name: Core Protection - Protect core McAfee files and folders
Threat Severity: Information
Threat Event ID: 1092
File Infected:
Event Description: Access Protection rule violation detected and blocked
Threat Handled: True
Action Taken: Blocked
Detection Method: Trust Validation
Detection UTC Time: 12/02/22 20:13:49 UTC
Received UTC Time: 12/02/22 20:17:01 UTC
DAT:
Analyzer Name: Redacted
Analyzer IP: Redacted
Analyzer MAC: Redacted
Source:
Source IP: Redacted
Source MAC:
Source Process:
Source URL:
Source Username:
Target:
Target IP: 10.2.22.13
Target MAC:
Target Process:
Target Username:
Target Protocol:
Target Port: 0
You Deserve an Award
