need to block exe file

[Vishal6]

Hi All,

Need to block below exe file path on server. Can anyone help me how can i do this in Cisco secure endpoint console.

c:\program files\uvnc bvba\UltraVNC\winvnc.exe

[Marvin Rhoads]

Use a Simple Custom Detection (SCD).

https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/215176-configure-a-simple-custom-detection-list.html

[Roman Valenta]

You can also create your own list under Outbreak Control ---> Application Control - Blocked Applications then apply that list to your policy. This will only work on *.EXE files and it will block that application from running.

[Vishal6]

Hi Roman,

Using upload file search only for that machine, but i want to block exe file that resides in server

[Roman Valenta · Accepted solution]

Not sure If I follow. If you want to block that particular file winvnc.exe you will need to either grab that file and upload to Blocked Application or determine/calculate the SH256 of that file and add that hash instead once you add that apply the Block Application list to the policy for that server to block running that EXE again.

Or do what Marvin suggested with Simple Custom Detection, you will also need to apply that to your policy for that server, then run full or partial scan which will remove the file all together upon detection.

Both solution works based on SHA256. However you need to remember that if the SHA256 will change lets say with new version you will need to adjust that policy again .

Unfortunately UltraVNC is not consider to be threat its just free software that can display screen of another computer (via the internet or network) on your own screen. In your case its unwanted software but for others they might use it in their environment. Also using valid certificates for the installer makes harder to deemed the file malicious. The latest UltraVNC looks like this. 

 

[junaid-rehman]

Hi @Vishal6 Could you please share more details about how you accomplished this? Like you did this exactly?