So I started testing the new EDR beta functions on my local machine and have been having the following false positives. It go so bad it even prevented me from starting the Automate Control Center on my machine, and I had to uninstall and roll back to normal.
'DynamicShellcode' exploit prevented in LTClient
'DynamicShellcode' exploit prevented in LTTray
No ammount of exceptions fixes this, as the PID and Detection ID change every time. I've included the raw data for the LT Client issue, but wasn't sure who to give this too.
itigation DynamicShellcode Timestamp 2020-06-03T15:01:10 Platform 10.0.18362/x64 v321 6f_02 PID 34160 Application C:\Program Files (x86)\LabTech Client\LTClient.exe Created 2020-05-13T22:43:46 Modified 2020-05-13T22:43:46 Description LTClient 3.0 Shellcode (HHA) (0x00060000 bytes) Owner of CALLER: (anonymous; clr.dll) OwnerModule Name clr.dll Thumbprint 7a33ad00e22a53d91dd1a6f097fd37d9c8a9cd3bd512070eb7ce988aaf722733 SHA-256 8c9899bf565c54bc2ee2fa11edf9b6840f44de77f1ecb050623f7560c7bfa807 SHA-1 1fb0ebc06f188e57f410cb2961d891ddbb314880 MD5 4853b707346cfb69b2052b9a00ae55b6 09AE44F8 ffd2 CALL EDX 09AE44FA c6460801 MOV BYTE [ESI+0x8], 0x1 09AE44FE 833d4820da7300 CMP DWORD [0x73da2048], 0x0 09AE4505 7407 JZ 0x9ae450e 09AE4507 50 PUSH EAX 09AE4508 e8737dc369 CALL 0x7371c280 09AE450D 58 POP EAX 09AE450E c745e800000000 MOV DWORD [EBP-0x18], 0x0 09AE4515 8bf8 MOV EDI, EAX 09AE4517 e8a49cb969 CALL 0x7367e1c0 09AE451C 8bc7 MOV EAX, EDI 09AE451E 8b7ddc MOV EDI, [EBP-0x24] 09AE4521 897e0c MOV [ESI+0xc], EDI 09AE4524 8d65f4 LEA ESP, [EBP-0xc] 09AE4527 5b POP EBX 09AE4528 5e POP ESI ----- SNIP HERE ----- AAMFAQBArgn4RK4JAACuCQBQAADkBQQAi/DotKG5aYvGi3XYiXcMjWX0W15fXcMFBACQIpoHBQQAiCKaB9CWpwdXVovxuTiWpwfoivB4+I14BIPGGLk4BQMA86VeX8MFAgCoIpoHBQQAoCKaBwCWpweLQTjDBRgAAgUDAOi7sLhpXgUCAAydpwcFBAD0AwUAAAUAAAUAAAX2ALAimgcMnacHVYvsV1ZTg+wgiUXwZIs1KA4FAgDHRdik/WZzx0XUSED3+YtGDIlF3Ilt7MdF6AUEAI1F2IlGDIvZi/qLTfDoLfXEaYtF8ItAFIsQ/3UI/3UMV1PHReAQBQMAiWXkx0Xo+kSuCcZGCAD/0sZGCAGDPUgg2nMAdAdQ6HN9w2lYx0XoBQQAi/jopJy5aYvHi33ciX4MjWX0W15fXcIIBQAABQAABQAABQAABQAABQAABQAABQAABQAABQAABdMA ----- END SNIP ----- Loaded Modules ----------------------------------------------------------------------------- 003F0000-01DDE000 LTClient.exe (), version: 75310000-75410000 hmpalert.dll (SurfRight B.V.), version: 3.7.17.317 75110000-7514E000 SOPHOS~1.DLL (Sophos Limited), version: 10.8.7.1000 6FF60000-709B5000 System.ni.dll (Microsoft Corporation), version: 4.8.4001.0 built by: NET48REL1LAST_C 5D3E0000-5D583000 System.Drawing.ni.dll (Microsoft Corporation), version: 4.8.3752.0 built by: NET48REL1 5A9A0000-5B806000 System.Windows.Forms.ni.dll (Microsoft Corporation), version: 4.8.4150.0 built by: NET48REL1LAST_C 6F1E0000-6F9F8000 System.Core.ni.dll (Microsoft Corporation), version: 4.8.4180.0 built by: NET48REL1LAST_B 5BED0000-5C2EB000 WindowsBase.ni.dll (Microsoft Corporation), version: 4.8.4180.0 built by: NET48REL1LAST_B 60130000-6025F000 CefSharp.Core.dll (), version: 57.0.0 0FC60000-13D73000 libcef.dll (), version: 3.2987.1601.gf035232 76E70000-76E7D000 UMPDC.dll (), version: 600B0000-60124000 chrome_elf.dll (The Chromium Authors), version: 57.0.2987.133 70BF0000-70CF5000 System.Configuration.ni.dll (Microsoft Corporation), version: 4.8.3752.0 built by: NET48REL1 6EA60000-6F1D4000 System.Xml.ni.dll (Microsoft Corporation), version: 4.8.3752.0 built by: NET48REL1 59C10000-5A84C000 PresentationCore.ni.dll (Microsoft Corporation), version: 4.8.4180.0 built by: NET48REL1LAST_B 57940000-58D25000 PresentationFramework.ni.dll (), version: 575F0000-577F3000 System.Xaml.ni.dll (Microsoft Corporation), version: 4.8.4180.0 built by: NET48REL1LAST_B 60060000-600A7000 System.Numerics.ni.dll (Microsoft Corporation), version: 4.8.3752.0 built by: NET48REL1 70DF0000-70F68000 SophosAmsiProvider.dll (Sophos Limited), version: 1.3.237.0 Process Trace 1 C:\Program Files (x86)\LabTech Client\LTClient.exe [34160] 2 C:\Windows\explorer.exe [10504] 3 C:\Windows\System32\userinit.exe [10316] 4 C:\Windows\System32\winlogon.exe [104] winlogon.exe 5 C:\Windows\System32\smss.exe [920] \SystemRoot\System32\smss.exe 000000e8 00000084 6 C:\Windows\System32\smss.exe [608] \SystemRoot\System32\smss.exe Thumbprint 54ce4109bfd09310394331cd311a82ceb4b7b83e540307f4289f3cda924688a1 Module based thumbprint 7a33ad00e22a53d91dd1a6f097fd37d9c8a9cd3bd512070eb7ce988aaf722733
I can launch Automate again for what it's worth.
Yeah, I got tired of being alerted every 10 seconds that the process was flagged, so I removed and reverted back to stable.
Hi Matthew,
This is related to the new Dynamic shellcode protection in our Intercept X early access; it is not related to the new EDR features in early access.
I'll send a PM with more details.
Regards,
Stephen
I am having this same issue.