Cisco AMP for Endpoints & IE ActiveX addon

[Kasim]

Hey all, 

Calling all AMP experts - Looking for some help with an issue that has been driving me bananas. 

My client has a website in which they open with IE and it loads an activeX addon (which is installed on the computer and has a C++ component to the installation). the page loads fully and properly without Cisco AMP installed. After installing AMP for endpoints, this page now partially loads and gives VB error. The addon does not load. 

I have set exclusions for the file in the installation folder for the addon - issue persists

I have tried a different version of the connector (even with our latest version available - 6.2.19.10882) - issue persists

I have stopped the cisco AMP service - issue persists

I have checked the trajectory of the endpoint and nothing is being blocked or marked as suspicious. 

Uninstalling AMP makes the addon load fully. I have checked every browser security setting and compared it to a machine that does not have AMP and they all match. 

I am at a brick wall and some help would be greatly appreciated. 

[Matthew Franks]

Sounds like it might be an Exploit Prevention incompatibility.  Please try adding the site to your Trusted Sites in Internet Explorer.

https://www.itg.ias.edu/content/how-add-trusted-sites-internet-explorer

Alternatively, you could disable Exploit Prevention in the policy as a test.

Thanks,

Matt

[Kasim]

Thanks Matt, I will try your suggestions 

[Kasim]

I tested adding the site to Trusted sites and that did not resolve the issue,

I disabled Exploit Prevention and that DID resolve the issue. The curious thing is that with that setting enabled, there were no "exploit prevented" events logged in the trajectory for that machine. Why would that be?

I will provide my results to the security admin but i doubt that having this setting disabled will be accepted. Is there anything else I can try that would not disable security features? Any possibility of setting exclusion for exploit prevention?

[Troja007]

Hello @Kasim,

saw the same behavior with a Client in my LAB where an Internet Banking Software was not able to start when Exploit Prevention is enabled. I also saw no event, no blocking, nothing. Only deactivating exPrev helped. 

Have you opened a TAC case for this issue? Would be interesting if there is a solution for this.

Cheers

[Kasim]

I havent yet opened a TAC case yet. That is most likely my next step.