topic Re: AntiExploit blocking Chrome and Edge in Endpoint

AntiExploit blocking Chrome and Edge

PCTI — Tue, 26 Oct 2021 08:17:42 GMT

Hello.

I am having problems in one client because Harmony Endpoint is blocking Chrome and Edge with no special reason.

I get alert that Anti-Exploit block threat, but i dont find anything that might cause this.

Endpoint version - 85.10.0575

More info in attach

Regards

Pedro

Re: AntiExploit blocking Chrome and Edge

Chris_Atkinson — Tue, 26 Oct 2021 23:53:22 GMT

Please follow-up with TAC regarding a permanent solution, in the interim see sk154455.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk154455

Re: AntiExploit blocking Chrome and Edge

Tobias_Karsbo — Tue, 26 Oct 2021 12:28:08 GMT

Same for us:

Chrome yesterday for some users, Edge today.

Id: c20e8565-81a0-5410-6177-efad27a60000
Sequencenum: 1
Product Family: Endpoint
Event Type: Forensics Case Analysis

Severity: High
Description: To exclude: Open the Harmony Endpoint Management -> policy -> Threat Prevention -> EXCLUSION CENTER -> Exclusion Settings -> Web and Files Protection -> Threat Emulation... -> + -> SHA1 -> paste this: d3d8253e-3bd458aa-19968b0c-312c774d-26baef79 Attack status: Cleaned.
Client Name: Check Point Endpoint Security Client
Product Version: 85.40.2076
Installed Blades: Firewall; Application Control; Anti-Malware; VPN; Anti-Bot; Forensics; Threat Emulation

Forensics Analysis: 457ab508-d779-4aa7-8720-89b8c60b407a
Triggered By: Endpoint Anti-Exploit
Attack Status: Cleaned
Protection Name: Gen.Exploiter.ROP
Protection Type: Generic
Malware Action: a ROP virtual memory allocation exploit
File Name: msedge.exe
File MD5: fda107354688b32939d7f3e4e286c069
File Type: exe
File Size: 8631461295071690752
File SHA-1: d3d8253e3bd458aa19968b0c312c774d26baef79
File SHA-256:
Confidence Level: High
Policy Name: Default Forensics settings
Policy Date: 2021-09-24T08:32:23Z
Policy Version: 18
Remediated Files: msedge.exe(Terminated before), msedge.exe(Terminated before), (Terminated before), msedge.exe(Terminated before), msedge.exe(Terminated before), msedge.exe(Terminated before), msedge.exe(Terminated before), (Terminated before)
Impacted Files:
Suspicious Events: Exploitation for Client Execution: msedge.exe; Drive-by Compromise: msedge.exe; User Execution: msedge.exe;
Incident Details: msedge.exe(fda107354688b32939d7f3e4e286c069);
General Information:
Service Domain: ep-demo
Action: Prevent
Packet Capture: Packet Capture
Type: Log
Blade: Forensics
Lastupdatetime: 1635250093000
Lastupdateseqnum: 1
Stored: true
Description: To exclude: Open the Harmony Endpoint Management -> policy -> Threat Prevention -> EXCLUSION CENTER -> Exclusion Settings -> Web and Files Protection -> Threat Emulation... -> + -> SHA1 -> paste this: xxxxxxxxxxxxxxxxxxxxxxxxx Attack status: Cleaned.

Re: AntiExploit blocking Chrome and Edge

tom_allen — Tue, 26 Oct 2021 18:44:32 GMT

Where can I see that SK? Anyone else have a solution?

Re: AntiExploit blocking Chrome and Edge

tom_allen — Tue, 26 Oct 2021 18:53:33 GMT

Nevermind, I found the SK but I would rather have a solution.

Re: AntiExploit blocking Chrome and Edge

MikeB — Tue, 26 Oct 2021 22:26:52 GMT

Same Issue with 4 endpoints, all with E85.40 version.

chrome.exe and msedge.exe affected.

Malware action: a ROP virtual memory allocation exploit

Protection Name: Gen.Exploiter.ROP

Re: AntiExploit blocking Chrome and Edge

tom_allen — Tue, 26 Oct 2021 22:30:01 GMT

Yes got a reply from Tech Support, know issue and the workaround is to add an exclusion.

Re: AntiExploit blocking Chrome and Edge

PCTI — Wed, 27 Oct 2021 08:43:19 GMT

I have updated to 85.40 with no sucess.

Re: AntiExploit blocking Chrome and Edge

Chris_Atkinson — Tue, 02 Nov 2021 00:02:15 GMT

Per above a workaround is currently required until a permanent fix is made available (E86.00).

Re: AntiExploit blocking Chrome and Edge

Pedro_Marques — Thu, 28 Oct 2021 10:07:32 GMT

Also have the same problem ... had to apply the workarround 😞

Re: AntiExploit blocking Chrome and Edge

Chris_Atkinson — Tue, 02 Nov 2021 00:01:45 GMT

Hi Tom,

The fix is included in E86.00 available now from sk175945.