Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Random .dll Blocks Occurring On Temporary asp.net Files

App Control: Random .dll Blocks Occurring On Temporary asp.net Files

Environment

  • App Control Agent: All Supported Versions
  • App Control Server: All Supported Versions
  • Microsoft Windows: All Supported Versions

Symptoms

Agent enforcing Execution Blocks on random .dll files associated with a temporary .NET Framework directory.

Cause

The temporary files are expected by the application to be created and executed before the App Control Agent would otherwise be able to fully analyze or issue the relevant Local Approval necessary.

Resolution

Create a new Custom Rule that uses the Rule Type, "Execution Control" and the Action, "Allow". 
  1. Determine the relevant Process and File Path(s) being blocked in the Console > Reports > Events.
  2. Use this information to create a new Custom Rule in Rules > Software Rules > Custom.
    • Status: Enabled
    • Rule Type: Execution Control
    • Execute Action: Allow
    • Path or File: Specify the File Path(s) determined in Step 1.
    • Process: Specify the Process determined in Step 1.
    • Save & Exit
  3. Confirm the Agent shows as Connected and Up To Date in Assets > Computers after creating the Custom Rule and attempt to recreate the Execution Block.

Additional Notes

  • This example Custom Rule can be further restricted by limiting to specific Policies, Users, or through the use of Wildcards.
  • More information on Custom Rules can be found in the User Guide chapter, "Approving and Banning Software".

Related Content


Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎04-21-2021
Views:
1165
Contributors