Endpoint Standard: November 2021 AMSI Prevention Rules Cause Blocking of Known Good Scripts

Endpoint Standard: November 2021 AMSI Prevention Rules Cause Blocking of Known Good Scripts

Environment

  • Endpoint Standard Sensor: 3.6.x.x and Higher
  • Windows OS: All Supported Versions

Symptoms


Cause

While we expect these alerts to provide high fidelity detections that detect malicious activity in the wild, we recognize that some customers will need to dismiss these alerts for future if they are not applicable to their specific environment. 

Resolution

  • Modification of AMSI rules to change from prevention to detection has been completed for all Production environments
  • This change will still result in a detection alert, but as a result the sensor will no longer block known good scripts

Related Content


Was this article helpful? Yes No
100% helpful (2/2)
Article Information
Author:
Creation Date:
‎12-06-2021
Views:
435
Contributors