Jump to content

json log file  blockedFileName values


ScottQ

Recommended Posts

I have a script blocked by "exploit protection" detecting VBscript started by browser.  The add on starts the command line:

WScript.exe C:\cmdpath-redacted\openwith_tc2.vbs E:\redacted.ext"

Looking for someone on Malwarebytes development team to clarify the json log report file -  https://pastebin.com/gfyHRKiL line:

"blockedFileName" : "C:\\Windows\\System32\\WScript.exe C:\\Windows\\System32\\WScript.exe C:\\cmdpath-redacted\\openwith_tc2.vbs E:\\redacted.ext"

 

Question #1:

Why is the reported value of "blockedFileName" :  ""C:\\Windows\\System32\\WScript.exe" repeated twice ?

Question #2:

Why is the reported value of "blockedFileName"  a command line and not a file name? (for now I will go on the assumption that also doubles as meaning "blocked command line".)

I only need information about these two questions.

Link to post
Share on other sites

16 minutes ago, ScottQ said:

I have a script blocked by "exploit protection" detecting VBscript started by browser.  The add on starts the command line:

 

18 minutes ago, ScottQ said:

Question #1:

Why is the reported value of "blockedFileName" :  ""C:\\Windows\\System32\\WScript.exe" repeated twice ?

Question #2:

Why is the reported value of "blockedFileName"  a command line and not a file name? (for now I will go on the assumption that also doubles as meaning "blocked command line".)

This will have to be answered by staff.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.