Hi,
I'm looking for a workflow suggestion.
We're managing an environment with Harmony Endpoint, however in that environment there's a strong need for tasks to be performed through batch files.
The issue is that Threat Emulation (very) often grabs these .bat files, despite them being written by a trusted administrator internally.
Now of course we could create an exclusion for the directory the admin writes the files in, but that only resolves the "creation" part, the issue is also quite often the distribution and successful execution after the fact.
We could suggest a move to Powershell scripts which can be signed by the organizations internal PKI, however would that be any guarantee that they wont trigger remediation on Threat Emulation regardless?
In interest of maintaing a secure environment the customer is willing to adjust their workflow, but I'd like to at least meet them half way and provide a workflow which will genuinely work.
We can add the signature into Forensics as an exclusion, but what good does that do if it's Threat Emulation that does the matching, unless a file being signed with the chain of trust valid also helps with TE.
Regards,
