topic Re: Whitelist file that has a dynamic SHA name in Endpoint Security

Whitelist file that has a dynamic SHA name

itguy1024 — Mon, 13 Sep 2021 14:38:53 GMT

Hello,

We have a .lnk file being pushed out by GPO that AMP has been blocking. AMP has been flagging it as Heur.BZC.ONG.Boxter.331.47822C71 and quarantining it.
I have been whitelisting it but noticed that in AMP the .lnk file has a different SHA name each time it gets quarantined. I'm guessing that's why it keeps getting blocked.
I did select the actual file .lnk file name and add to whitelist but assuming it's the same issue with the SHA names.

Is there any other way to add a file to the whitelist that doesn't look at the SHA names?

Re: Whitelist file that has a dynamic SHA name

Wojciech Cecot — Tue, 14 Sep 2021 11:17:24 GMT

Hello,

Based on the detection name, files in question are detected by TETRA engine (signature based engine, like traditional AVs) - to confirm that, you can check details in Device Trajectory - it should display which engine was involved. Please refer to example from my lab:

The best way to address that -> open ticket with Talos and provide sample + engine that detected file under https://talosintelligence.com/tickets

Once they will review the file and confirm it is False Positive, all files with the same file properties should not be detected by Secure Endpoint anymore.

-Wojciech

Re: Whitelist file that has a dynamic SHA name

itguy1024 — Tue, 14 Sep 2021 12:45:14 GMT

It was detected by Tetra. I opened a ticket but it was asking for the SHA name, which is dynamic. So we'll see what happens.

Re: Whitelist file that has a dynamic SHA name

itguy1024 — Thu, 16 Sep 2021 14:35:15 GMT

Update: Talos closed my case and marked it as no change. They stated that AMP is not blocking the file and I should open a TAC case. This is odd because I can watch AMP quarantine the file in real time when I try to deploy it.
I guess I'll see what TAC says.