Harmony Endpoint Behavioral Guard stops certutil.exe

[neronidis]

Hello all,

after we have install the DHS Approved version (88.50) we are receiving very often the messages that certutil.exe was stopped by the behavioral guard. Thankfully the process is just stopped and not deleted or smth. As you already know this is a very important windows binary that can also be used for malicious purposes (LOTL attacks). So far we have identified that it is definately a false positive. The certutil is used by a local agent that uses the certutil.exe in order to check the Hash value of the packets that it receives from a server. 

Is anyone other in this forum facing the same issues? 

Adding an exlusion on the behavioral guard is possible but unfortunately the filtering options are limited. The distinguish between malicious and legit usage of the binary can be done only by filtering the command's arguments. Which is unfortunately not possible with the "add exclusion" option...

[PhoneBoy]

I've seen a couple of TAC cases where this was specifically mentioned, but did not see any specific instructions.
I assume it depends on what exactly is triggering certutil.

[neronidis]

Well, the agent that trigers this behavior is the Forescout NAC agent. So yes it is a very legit application. The certutil is also called with the "-hashfile" argument. This means NO danger. It is being used for verification purposes. This should be clear to the Devs Team.

I expected more logic behind the behavioral guard.

[G_W_Albrecht]

Open a SR# with TAC so they can look into this ! Usually, they will not use a competitors solution for their tests, and two endpoint solutions fighting against each other is not a standard use case...

[neronidis]

hello and thank you for the reply,

Forescout NAC agent is not a competing endpoint solution. In addition to that, the two of them have coexisted (not integrated! yes there is this option, too) on our endpoints for a long long time. 

I came here once again for some quick knowledge since opening a ticket is a long and painful process.

Have a nice day.

[G_W_Albrecht]

Forescout NAC is a completly different approach, and CP SW will not do ACL or control network hardware - but regarding EP compliance and security, they partly are competing, and i think that is the reason for your issue...

Opening a CP Ticket is usually not long and painfull.

[PhoneBoy]

Not sure this is a competitor exactly.
In any case, because it’s a false positive, a TAC case is the correct avenue to get this resolved.