Another week, another BTP quirk: Behavioral threat detected (rule: sync.enable_safemode_on_next_reboot) spawned from VEEAM

[RobertoPastorino]

We are observing VEEAM VeeamTransportSvc.exe being blocked by BTP and, thus, preventing backups from being started.

We are working on a temporary fix excluding path and cgo and the likes but this is the second week in a row that content updates are screwing, this time impacting operations.

Already filled a support case.

BR

[Guy.Ashkenazi]

just open https://knowledgebase.paloaltonetworks.com/

and type VEEAM the first option give you the KB

i got the new CU and that still block my app, i add the CGO for now.

Behavioral Threat Protection event on the rule sync.enable_safe... - Knowledge Base - Palo Alto Netw...

[Gerry_Fahy]

Yes, I updated to CU650-11590 and Veeam is still blocked.

[RobertoPastorino]

I think that the VSS is still blocked and the relevant services need a restart as noted in a previous comment.

[RobertoPastorino]

Yeah thanks, unfortunately the KB is "please do an alert exception" but given the services involved I would not do that.

[maksymilianjan]

Well the exception is just for this BTP rule which considering that is from two days ago I do believe is the best solution until they solve this issue on their side.

[Gerry_Fahy]

Yes, I've created the exception just for this rule and just applied to those machines backed up by Veeam...

[parkerjr2]

Here's the link.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wlJGCAY

[RobertoPastorino]

Yeah I know but the "Boot in safe mode" abuse is all the rage right now and is actively used in the wild.
PA stated that a CU with the fix has been released so I'll rather wait for it to be acquired by the agents.

[FrankBussink]

Hi,

CU650-11590 doesn't fix it for us 😞

still the same BCD operation

[Gerry_Fahy]

Unfortunately the fix still doesn't work, and I think the risk of not having an up-to-date AD backup is greater 😉

[RobertoPastorino]

Relevant VEEAM Kb
https://www.veeam.com/kb1697

[....]
Many anti-virus solutions have developed modules that monitor and prevent access to the boot configuration data (BCD). These "boot protection modules" have been observed to prevent Veeam's Application-Aware Processing processing from working with Domain Controllers. During the backup job's Application-Aware Processing step, for Domain Controllers only, the BCD is temporarily modified to enable SafeBoot.
[...]

[RobertoPastorino]

Did you restarted the services mentioned here by @parkerjr2  ?

https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/another-week-another-btp-quirk-behaviora...

[Gerry_Fahy]

I restarted the server. Still didn't work.

[parkerjr2]

Yesterday before any resolution was provided, I observed restarting the server did nothing but restarting the services did work. Don't ask me why.

[FrankBussink]

FYi : I've uploaded the SUEX file (a json format file to be uploaded in the Policy Global Exceptions/Support Exception) provided by the PAN support, as I need the backups to run this week-end while we wait for PAN to get a proper fix