topic Re: Devolutions - Remote Desktop manager - reported as ransomeware - Harmony Endpoint - Behavioral G in Endpoint

Devolutions - Remote Desktop manager - reported as ransomeware - Harmony Endpoint - Behavioral Guide

Mitja-S3NEXT — Fri, 12 Apr 2024 07:21:48 GMT

This was alreasy sent to the emergency response e-mail

Incident: 6c157e2b-5e8a-4d1e-9a17-5d70e5f2ba2f
Status: Active
User: *******
Computer: *******
OS: Windows 10
Trigger: c:\windows\system32\rundll32.exe
Triggered by: Endpoint Behavioral Guard
Trigger Time: 12. 4. 2024, 08:54:24
Protection Name: behavioral.win.anonymousmemorype.a
Entry Point: ****-PC\**** was logged in. msiexec.exe created [remotedesktopmanager_x64.exe]

Re: Devolutions - Remote Desktop manager - reported as ransomeware - Harmony Endpoint - Behavioral G

G_W_Albrecht — Fri, 12 Apr 2024 08:24:27 GMT

Why not open SR# with CP TAC?

Re: Devolutions - Remote Desktop manager - reported as ransomeware - Harmony Endpoint - Behavioral G

Mitja-S3NEXT — Sat, 13 Apr 2024 18:59:51 GMT

Service Request: 6-0003913660 opened 👍

Re: Devolutions - Remote Desktop manager - reported as ransomeware - Harmony Endpoint - Behavioral G

Mitja-S3NEXT — Tue, 23 Apr 2024 12:18:55 GMT

Solution Description form CP TAC service request: Remote admin tools are considered PUA under Check Point's policies due to their capabilities, therefor this one is considered TP. If the customer trusts the use of this specific one internally and uses it safely he may create a local exception for this one. Exclusion suggestion provided