Disable Protection Rule for Remote Initiated Behavioral Threat

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Disable Protection Rule for Remote Initiated Behavioral Threat

L2 Linker

We are creating a custom service to handle automatically checking and updating programs (similar to PDQ Deploy, or an RMM tool).

We've signed the the created service and tried several ways to disable it from being blocked. The problem is, we are very limited in what we can target with the disable prevention rules. 

Has anyone run into this and actually allowed it through. We could change the commands to not trigger the alerts as we can see what triggered them by getting the alert data.

The point is that if we signed what is running, we'd like to be able to build it out without worrying about coding around XDR's every changing (and hard to extract behavioral rules).

 

We've already attempted to:

  1. allow our signature in a disable prevention rule
  2. allow the ending powershell process with a wildcard cmd line argument

The problem seems to be that the point where the block is triggered happens before the signer is considered. The artifacts show our service as being signed.

CJNTS_5-1708639694767.png

 

 

Screenshot of causality chain nodes below.

CJNTS_2-1708639146320.png

 

CJNTS_0-1708639964650.png

 

 

CJNTS_3-1708639258518.png

Disable Prevention Rules does not give us any way to address this.

CJNTS_4-1708639365181.png

 

 

2 REPLIES 2

L5 Sessionator

Hi @CJNTS, thanks for reaching us using the Live Community.

Is the powershell script located in a specific folder?

Have you tried with a Legacy Agent Exception for the Behavioral Threat Prevention module which is the one blocking here?

 

jmazzeo_0-1708693824490.png

 

JM

We've looked into that, but don't want to take that route.

As we build things out, different scripts will run from the same folder structure. To create this rule, we'd have to make a bunch of exceptions for each file path, or wild card the last piece (script name).

From what I've looked at if we did it this way we wouldn't be able to also evaluate the signer. I think this may work, but it would be creating a bigger hole in protection than we're aiming for.

 

If I'm wrong on any of that, please let me know. We really want to evaluate based on the signer. If we could consider a wildcard file path AND the signer, this would be a consideration.

  • 1163 Views
  • 2 replies
  • 4 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!