Dell CommandUpdate suspends Bitlocker before a BIOS update, Harmony Endpoint takes it the wrong way

[joesternna]

I'm slowly migrating from Microsoft Defender to Check Point Harmony Endpoint. 

Today I discovered that when Dell CommandUpdate attempts to suspend BitLocker before a BIOS update, Harmony Endpoint detects the action as ransomware (a false positive) and disrupts the event. For good measure, Playblocks then isolates the computer for 24 hours, but that is a downstream effect. 

If I manually suspend Bitlocker through the Windows GUI, that action is allowed to proceed. It's when c:\windows\system32\wbem\wmiprvse.exe tries to do it that alarms go off.

Does anyone have a way to allow a trusted program like CommandUpdate to work with wmi?

Thanks,

Joe

[Chris_Atkinson]

Which Endpoint client version is involved, have you attempted any exclusions or reported the symptoms via TAC?

[joesternna]

---

@Chris_Atkinson wrote:

Which Endpoint client version is involved, have you attempted any exclusions or reported the symptoms via TAC?

---

I'm using the latest at the time of this posting, 87.52. 

When I look in the incident logs in Infinity Portal for the bitlocker suspension being prevented, there is no reference to the Dell utility. Harmony sees the incident being triggered by the wmiprvse service. It seems imprudent to add wmiprvse as an exclusion, as it can be used by living-off-the-land attacks. 

I have not yet engaged TAC. 

[ICSI]

I have the same problem with Harmony Endpoint. at this point probably you already have resolved your issue. But let me record a video of what I think you might want to do.

How many computers are you updating at the time? 

[joesternna]

---

@ICSI wrote:

How many computers are you updating at the time? 

Because end users can run the updates at a time convenient to them, it's only ever one at a time. 

At this point probably you already have resolved your issue.

---

My resolution was to push out an xml file to DellCommandUpdate that excluded BIOS updates from the available update types. I can let Windows Update for Business handle the BIOS updates if they are necessary. Although, if it's possible, I would prefer to move the BIOS update back to CommandUpdate if we can get Harmony to trust it to call wmiprvse.exe.