XSIAM-ENGINEER · Question #23
A Behavioral Threat Protection (BTP) alert is triggered with an action of "Prevented (Blocked)" on one of several application servers running Windows Server 2022. The investigation determines the…
The correct answer is B. Create a Disable Prevention Rule via Exceptions Configuration with the following selections. The most secure approach is to create a Disable Prevention Rule via Exceptions Configuration, scoped specifically to the Exceptions-AppServers profile. This rule should include the hash (SHA256), signer (Microsoft Corporation), and file path (C:\Windows\System32\cmd.exe). This…
Question
A Behavioral Threat Protection (BTP) alert is triggered with an action of "Prevented (Blocked)" on one of several application servers running Windows Server 2022. The investigation determines the involved processes to be legitimate core OS binaries, and the description from the triggered BTP rule is an acceptable risk for the company to allow the same activity in the future. This type of activity is only expected on the endpoints that are members of the endpoint group "AppServers," which already has a separate prevention policy rule with an exceptions profile named "Exceptions-AppServers" and a malware profile named "Malware-AppServers." The CGO that was terminated has the following properties:
- SHA256:
eb71ea69dd19f728ab9240565e8c7efb59821e19e3788e289301e1e74940c208
- File path: C:\Windows\System32\cmd.exe
- Digital Signer: Microsoft Corporation
How should the exception be created so that it is scoped as narrowly as possible to minimize the security gap?
Options
- ACreate the exception via the alert itself, selecting the CGO hash, CGO signer, CGO process path,
- BCreate a Disable Prevention Rule via Exceptions Configuration with the following selections:
- CCreate a Legacy Agent Exception via Exceptions Configuration with the following selections:
- DCreate the exception via the alert itself, selecting the CGO hash, CGO signer, CGO process path,
How the community answered
(37 responses)- A8% (3)
- B65% (24)
- C22% (8)
- D5% (2)
Explanation
The most secure approach is to create a Disable Prevention Rule via Exceptions Configuration, scoped specifically to the Exceptions-AppServers profile. This rule should include the hash (SHA256), signer (Microsoft Corporation), and file path (C:\Windows\System32\cmd.exe). This ensures the exception is applied only to the trusted, legitimate process on the AppServers group while minimizing the security gap.
Topics
Community Discussion
No community discussion yet for this question.