- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
01-13-2025 04:17 AM
Hello,
I have an exception rule on a file that is being applied correctly. The file executes because of this exception, but in the user agent you get a warning that an unusual activity has been encountered or that a malicious activity has been encountered even though the file executes.
How can you prevent the user from getting this notification?
Thank you
01-15-2025 09:14 AM
Hi @s.martin720094, thanks for reaching us using the Live Community.
What type of exception have you created? Have you selected all the modules that generates the alert in the configuration?
01-17-2025 01:38 AM
Hi, I have an exception made in:
Legacy Agent Exceptions at executable file signature level.
Malware > Portable Executable and DLL Examination
Another exception in: Disable Prevention Rules in the following modules:
DLL Security, DEP, Null Deflection Protection, Memory Limit Heap Spray Check, Execution Protection, Media Control, Child Process, SEH Protection, ROP Mitigation, Source Protection, DLL Hijack Protection, Hot Patch Protection, Shell Link Protection, WildFire, Shellcode Preallocation, Library Preallocation, Exception Heap Spray Check, WildFire Post Detection, CPL Execution Protection, JIT Mitigation, Exception System Exit Check, Hash Control, Local Analysis, WildFire - Grayware, Kernel Privilege Escalation Protection, Exploit Kit Fingerprinting Protection, Child Process Protection, Anti-Ransomware Protection, APC Guard, Behavioral Threat Protection, Digital Signer Restriction, MBR Protection, Java Deserialization Protection, Network Packet Inspection Engine, Threat Intelligence Management, Anti Webshell Protection, Credential Gathering Protection, Financial Malware Threat Protection, Cryptominers Protection, In-process shellcode Protection, Malicious Device Prevention, UAC Bypass Prevention, Anti Tampering Protection, IIS Protection, UEFI Protection
Thanks
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!