False Positive - Creating a New Folder on a non-mapped Network Share

[tdhaslett]

Hi All,

Wondering if there is a simple fix for this as I have not been able to find anyone else with this issue online. Running MBAE 1.12.2.124.

I am trying to download an .exe in Firefox. I browse to a network share that is not mapped as a drive, and when I click New Folder, AE takes over and kills Firefox.

• If I save the file to an existing folder, it downloads fine.
• If I create a new folder in a mapped network drive, it works fine and I can download.
• If I create a new folder in a local drive, it works fine and I can download.

The file that it reports as being blocked is not the file that I was downloading. The file that it reports as being blocked is always a file that resides in the folder in which I am trying to create the new folder. So far, in the six times that it has blocked this, it has cited two different files - though there are many other files in the folder as well.

Since it is easy to work around, it is not a show-stopper, but it is annoying.

[CHMOD_777]

Hello Tdhaslett,

 

Based on the issue you are experiencing, I would need to collect some logs from the endpoint.  I will be opening a support case and sending you follow up on how to collect the required logs.

 

Warm Regards,

[pbust]

Try disabling the LoadLibrary protection for Browsers under the Anti-Exploit Advanced Settings -> Application Behavior protection.