Why is threat prevention unaware of what changes Microsoft makes in updates?

[enxl2]

Hello,

Over the past couple of months I have become really annoyed with the threat prevention product because it seems to be totally unaware of the fact that Microsoft releases updates for it's products.

For example today I received a bunch of false positives for this "Powershell Command Restriction - Command" when our Exchange server had the audacity to update itself.

Module Name:  Threat Prevention

Analyzer Content Creation Date:              10/20/20 10:19:00 PM EDT

Analyzer Content Version:          10.6.0.10775

Analyzer Rule ID:             6086

Analyzer Rule Name:      Powershell Command Restriction - Command

Source Description:              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command . 'D:\Exchange\\scripts\customization\CustomPatchInstallerActions.ps1' PostPatchInstallActions

Target Hash:      7353f60b1739074eb17c5f4dddefe239

Target Signed:   Yes

Target Signer:    CN=MICROSOFT WINDOWS, O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US

Target Parent Process Signed:    Yes

Target Parent Process Signer:     C=US, S=WASHINGTON, L=REDMOND, O=MICROSOFT CORPORATION, CN=MICROSOFT CORPORATION

Target Parent Process Name:      QUIETEXE.EXE

Target Parent Process Hash:       5bf45e9cedd1d9ff0d40e9bb8cc80aab

Target Name:    POWERSHELL.EXE

Target Path:       C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0

Target File Size (Bytes):  448000

Target Modify Time:       9/14/18 11:14:14 PM EDT

Target Access Time:        9/14/18 11:14:14 PM EDT

Target Create Time:        9/14/18 11:14:14 PM EDT

API Name:          AtlComPtrAssign

First Action Status:         Not available

Does McAfee not get a feed from Microsoft that tells the McAfee products what changes to expect during their patching? How do I protect our organization from actual powershell borne threats without getting spammed to death with false positives for routine OS updates?

[mpatel127 · Accepted solution]

Hi @enxl2 ,

Thank you for reaching out to McAfee Community for clarification.

The event which are getting generated are expected as per the EP Rule 6086 behavior and we think it's a false positive for your environment. If you want to deal with it, Please follow the solution mentioned by my colleague here on this post  (Kindly refer marked as solution comments.)>>https://community.mcafee.com/t5/Endpoint-Security-ENS/Problem-with-exclusion-for-endpoint-threat-pre... 

Hope this helps!

Was my reply helpful?

If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[enxl2]

It's a false positive in every windows 10 environment on the planet Earth.

Thats the problem.

Update your rules.