Could you help me with issue we are facing? We use PatchMyPC-ScriptRunner.exe tool for automatic software deployment/checks and this tool is creating a records in the registry similar to:
\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\XYZ.exe
Cisco CSE is generating events due to the registry changes -alert name: The registry was updated to add a debugger to the key: Image File Execution Options.
Is there any way how to either mute or whitelist this activity? We have confirmation that usage of this tool is needed and necessary and that it is legitimate tool.
I've tried to add the hash to the application whitelist + create file scan exclusion, but we still receive events. Based on the event the detection was made by behavioural engine.
I would appreciate any help.
thanks
marcel
