Devolutions - Remote Desktop manager - reported as ransomeware - Harmony Endpoint - Behavioral Guide

[Mitja-S3NEXT]

This was alreasy sent to the emergency response e-mail

Incident: 6c157e2b-5e8a-4d1e-9a17-5d70e5f2ba2f
Status: Active
User: *******
Computer: *******
OS: Windows 10
Trigger: c:\windows\system32\rundll32.exe
Triggered by: Endpoint Behavioral Guard
Trigger Time: 12. 4. 2024, 08:54:24
Protection Name: behavioral.win.anonymousmemorype.a
Entry Point: ****-PC\**** was logged in. msiexec.exe created [remotedesktopmanager_x64.exe]

[G_W_Albrecht]

Why not open SR# with CP TAC?

[Mitja-S3NEXT]

Service Request: 6-0003913660 opened 👍

[Mitja-S3NEXT · Accepted solution]

Solution Description form CP TAC service request: Remote admin tools are considered PUA under Check Point's policies due to their capabilities, therefor this one is considered TP. If the customer trusts the use of this specific one internally and uses it safely he may create a local exception for this one. Exclusion suggestion provided