Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
joesternna
Participant

Dell CommandUpdate suspends Bitlocker before a BIOS update, Harmony Endpoint takes it the wrong way

I'm slowly migrating from Microsoft Defender to Check Point Harmony Endpoint. 

Today I discovered that when Dell CommandUpdate attempts to suspend BitLocker before a BIOS update, Harmony Endpoint detects the action as ransomware (a false positive) and disrupts the event. For good measure, Playblocks then isolates the computer for 24 hours, but that is a downstream effect. 

If I manually suspend Bitlocker through the Windows GUI, that action is allowed to proceed. It's when c:\windows\system32\wbem\wmiprvse.exe tries to do it that alarms go off.

Does anyone have a way to allow a trusted program like CommandUpdate to work with wmi?

Thanks,

Joe

 

0 Kudos
4 Replies
Chris_Atkinson
Employee Employee
Employee

Which Endpoint client version is involved, have you attempted any exclusions or reported the symptoms via TAC?

CCSM R77/R80/ELITE
0 Kudos
joesternna
Participant


@Chris_Atkinson wrote:

Which Endpoint client version is involved, have you attempted any exclusions or reported the symptoms via TAC?


I'm using the latest at the time of this posting, 87.52. 

When I look in the incident logs in Infinity Portal for the bitlocker suspension being prevented, there is no reference to the Dell utility. Harmony sees the incident being triggered by the wmiprvse service. It seems imprudent to add wmiprvse as an exclusion, as it can be used by living-off-the-land attacks. 

I have not yet engaged TAC. 

0 Kudos
ICSI
Collaborator

I have the same problem with Harmony Endpoint. at this point probably you already have resolved your issue. But let me record a video of what I think you might want to do.

How many computers are you updating at the time? 

Regards,

Oscar Catana
https://ipthub.com

Cyber Sec Passionate!
0 Kudos
joesternna
Participant


@ICSI wrote:

How many computers are you updating at the time? 

Because end users can run the updates at a time convenient to them, it's only ever one at a time. 

At this point probably you already have resolved your issue.


My resolution was to push out an xml file to DellCommandUpdate that excluded BIOS updates from the available update types. I can let Windows Update for Business handle the BIOS updates if they are necessary. Although, if it's possible, I would prefer to move the BIOS update back to CommandUpdate if we can get Harmony to trust it to call wmiprvse.exe.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events