I try upgrade Treelix anget but It is not posible because ENS blocked the upgrade. We have found that ENS block msiexec to modify file and registry of Treellix installation.
The locks are:
- Exploit prevention. LOG-
- SelftProteccion LOG-
We could allow msiexec globally but I think it is not safe. Is it possible to enable it only for Trellix products installed by ePo?
Old Agent Version - 184.108.40.2064
New Agent Version - 220.127.116.112
ENS Version - 10.7
ePo Version - 5.10 Update 15
Apologies for the delayed reply.
msiexec.exe in your PC might not been trusted by ENS.
You might need to do Windows Update and update Root Cert that described following article.
Hi @GCDC ,
Exploit Prevention Rule ID 344 i.e. T1547 - New Startup Program Creation, is designed to block applications from registering themselves in startup/logon such as HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\.
This is a common behavior by legitimate application but also seen with malicious executables.
In this case you could take the following approach.
1. Add an exclusions for msiexec including its path. [Note:- This also bypasses misexec from all other Exploit Prevention Rules]
2. Disable Rule ID 344.
Was my reply helpful?
If you find this post useful, Please give it a Kudos! Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!
I'm going to read the articles and do tests.
We import Registry by Gpo, from this KB91697, and KB92948 (cert) but It won´t work.
Hi @GCDC ,
If you have already installed root certificate which is needed by ENS from KB91697, You should try to reset VTP service with the following steps. VTP service is used to check if a module is trusted or not.
1. Start a command prompt with administrator privileges.
2. Enter the following command.
> cd C:\Program Files\Common Files\McAfee\SystemCore
3. Enter the following command
> vtpinfo.exe /resetvtpcache
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.
Thousands of customers use our Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:
TrellixSkyhigh Security | Support Trellix.com SkyhighSecurity.com