App Control: "c:\windows\system32\ondemandconnroutehelper.dll" Blocked Because Agent Did Not Have Time To Analyze It

[#1]

Environment

• App Control Server: 8.6.0 and Higher
• App Control Agent: 8.5.0 and Higher

Symptoms

• "c:\windows\system32\ondemandconnroutehelper.dll" blocked on endpoints because agent did not have time to analyze it.
• Implementing A/V exclusions does not resolve issue
• Implementing agent configs related to "still unanalyzed" blocks does not resolve issue:  App Control: Agent Configs Commonly Used for Unanalyzed Blocks, Unhashed Blocks, & Timeouts

Cause

Root cause still under investigation.

Resolution

Create a new custom rule under "Rules > Software Rules > Custom":

Rule Name: 
Rule Type: Execution Control
Execution Action: Allow

File or Path: specific path
c:\windows\system32\ondemandconnroutehelper.dll

Process: Specific process
c:\windows\system32\svchost.exe
User or Groups
Policies:
Save

Related Content

App Control: Agent Configs Commonly Used for Unanalyzed Blocks, Unhashed Blocks, & Timeouts