In need of a little help!
I test my users every month with simulated phishing emails that come from KnowBe4. I haven't had an issue with Check Point Endpoint scanning and finding the attachments within those simulated emails as "malicious" until early September 2023. Once the email is delivered to the users inbox, it could take 1 minute for Endpoint to quarantine it, or 30 minutes. But once Endpoint quarantines it, it marks it as "opened" and/or "clicked" in the KnowBe4 Phishing report, which is false.
Harmony Endpoint Threat Emulation is the specific blade on my E87.31 client that is finding the attachment in this file path as malicious: C:\Users\*user*\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\QFG6XUIG\package-ID97000.pdf
- I've found the common folder each time the malicious file is found is that QFG6XUIG folder, but that's just on my computer
- the package-ID97000.pdf does change, depending on what that simulated email is sending for an attachment
- KnowBe4 has sent .zip and .pdf files, and this issue is happening for both of those file types
I don't want whitelist a specific folder path, as it's not the same for all users, and I don't want to exclude a path that could legitimately hold a malicious file from a legitimate phishing email.
Has anyone else run into this issue lately? And moreover, has anyone found a good solution to resolve this so the reporting is skewed?
Thanks in advance!
