Veeam Guest Interaction Proxy creates false IPS Alerts

Hi Peter Riederer ,

Thank you for reaching out to the community, the following IPS signature is FILE-OTHER Adobe Premier Pro ibfs32.dll dll-load exploit attempt, is up to date in the IPS Signature database, you can refer here. CVE-2010- 3150. There are no known issues. Request you to scan the source machine thoroughly with an endpoint.  

Hello Vivek,

on both Servers Sophos Intercept X (MDR Complete) is running and up2date.

Regards

Peter

did you check the source's traffic for any malicious web traffic ?

We disabled the use of guest interaction proxy last night, and the errors to the guest interaction proxy disappeared.
But another Server still produces the error, while veeam is reporting vss errors for the same machine in the same timeframe:

Failed to index guest file system. VSSControl: Index failed
Processing finished with warnings at 25.11.2024 20:19:42

it seems there are two issues with this IPS Signature ID 18530
(didnt notice there are two 18529 and 18530 with the same name)

We disabled the use of guest interaction proxy last night, and the errors to the guest interaction proxy disappeared.
But another Server still produces the error, while veeam is reporting vss errors for the same machine in the same timeframe:

Failed to index guest file system. VSSControl: Index failed
Processing finished with warnings at 25.11.2024 20:19:42

it seems there are two issues with this IPS Signature ID 18530
(didnt notice there are two 18529 and 18530 with the same name)

If you think this are false positive you can also add it to the IPS exceptions...