Anti-Exploit detection blocking Excel files

[leobando]

Hi,

I had a user having Anti-Exploit blocking Excel files pulled from our network shared drive.        

Exploit attempt blocked BLOCK......................Microsoft Office Excel    C:\Program Files\Microsoft Office\Office16\EXCEL.EXE   Attacked application: C:\Program Files\Microsoft Office\Office16\EXCEL.EXE; Parent process name: explorer.exe; Layer: Application Behavior Protection; API ID: 301; Address: ; Module: ; AddressType: ; StackTop: ; StackBottom: ; StackPointer: ; Extra:

This behavior start happening yesterday and the user was not able to work, is there a reason why suddenly Anti-Exploit blocked all these files?

Thank you

 

[Arthi]

Hi leobando,

Thanks for your post. Can you please provide this log file

C:\ProgramData\Malwarebytes\MBAMService\logs\mbae-default.log

Thank you.

[leobando]

Hi Arthi,

I still have the on premises version of Malwarebytes Management Console, the client version is 1.8.03443, I do not see MBAMService folder in that location.

I have this C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\Logs

Thank you 

[Arthi]

Hi leobando,

Oh I am sorry, did not realize you were on our Business product. 

Please ZIP the entire contents (ALL the files, not just .LOG) of the following directory

C:\ProgramData\Malwarebytes Anti-Exploit 

Thank you.

[leobando]

Here. Thank you

Malwarebytes Anti-Exploit.zip

[Arthi]

Hi leobando,

Can you restore to default settings by following the instructions as in the screenshots below. Thank you.

Apart from this please also ensure that the following setting is unchecked

After the above 2 steps if the block still occurs, please uncheck the following setting

 

 

[leobando]

Hi Arthi,

I've just changed the settings as you described

Do you have an idea what it was triggering the blocking? How bad is it to have that setting turned off?

I also see my Protection for MessageBox payload is turned off by default, should I turn it on?

Thank you