Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Block Write Rule to UNC Path

Block Write Rule to UNC Path

Version

Cb Protection 7.2.x

Issue

Custom Block Write rules do not stop writes to UNC paths.

Symptoms

In the Bit9 console: Rules > Software Rules > Custom tab

Rule Type: Advanced

Operation: Write

Write Action: Block

When this rule is applied, if a local path is entered under "Path Or File", the rule will work as intended.  If this is a UNC path, no block will actually occur and writes will be allowed to this directory.

Cause

Cb Protection only tracks execute actions over a UNC path, but does not track write actions to a UNC path.

Solution

The best way to configure these network shares would be to utilize NTFS(Active Directory) and Sharing permissions, outside of Cb Protection

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-03-2016
Views:
876
Contributors