We use SCCM to deploy most of our corporate applications. Many of these applications are home grown apps that are prone to triggering a false positive malware detection. We are working on digitally signing these application but in the mean time we are looking for ways to basically honor SCCM deployments as legit.
Would whitelisting the ccmexec.exe process achieve this objective? While this is the process that copies the files down from SCCM and launches most of the apps....there are times where it extracts the binaries from a compressed file, drops them in a temp folder and then launches the install.
I am going to do some testing, but wanted to poll the community to see if anyone else has some experience with this situation. Thanks in advance!
I suspect whitelisting ccmexec.exe won't achieve the goal you have in mind. That will allow that particular application to run, but depending on your policies (execution restrictions), Traps may block the execution from Temp folders.
Ultimately, you are looking to whitelist the corporate apps that will be running, not ccmexed.exe, right?
Here are a few of suggestions:
Keep in mind that the Execution Restrictions are always checked, regardless of which other malware prevention methods are invoked. So be sure to verify these restrictions match what you're looking to set up.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!