[1.04.1.1007 + 1.04.1.1008] Java x64 not shielded

[FleischmannTV]

Hi there.

 

I've been trying the 1007 and 1008 builds and it seems Java x64 is not shielded. I've double checked with process explorer to confirm that no dll is injected.

 

Best regards

 

 

logs.zip

[pbust]

I'm assuming you have searched for mbae64.dll and not mbae.dll.

 

The other reason why this could be happening is due to the new approach we have for protection of Java apps. Depending on certain conditions we might uninject from certain java processes if they are deemed "safe". This is to reduce FPs but doesn't affect the exploit detection capabilities.

[FleischmannTV]

I'm assuming you have searched for mbae64.dll and not mbae.dll.

 

Yes, mbae64.dll is not injected into javaw.exe.

[pbust]

Yes, then it's the new logic for the Java shield. It's expected behavior.