Exploit protection blocking certain excel spreadsheets from opening

[Roj9]

Currently have a client who cannot open certain excel spreadsheets. I have disabled exploit protection as a temporary fix. Their colleagues can all open the documents and I cannot find any difference in settings between them. 

Can send logs etc if you can let me know which?

thanks

[lmacri]

Hi Roj9:

If you can Export the detection log found at Detection History | History to a .txt file (see the first image below) and then paste the contents in your next reply someone should be able to confirm if your client's Exploit Protection detection is a false positive, and if so, how to temporarily change their Exploit Protection settings to prevent these false positive warnings.

 

Many users have recently reported Exploit Protection blocks for MS Office in the False Positives | Exploit board.  See my 16-Sep-2021 thread MS Word and Excel 2019 - Exploit Office WMI Abuse Blocked (cmd.exe) for one example.  When I view the detailed detection log at Detection History | History the Protection Technique says "Exploit Office WMI Abuse Blocked" (your client's Protection Technique might be slightly different)...

... and if I wish, I can temporarily DISABLE the Exploit Protection settings at Settings | Security | Exploit Protection | Advanced Settings | Application Behaviour Protection | Office WMI Abuse Prevention (enabled by default) to prevent these false positive detections until Malwarebytes releases a bug fix.

-------------
64-bit Win 10 Pro v21H1 build 19043.1237 * Firefox v92.0.1 * Microsoft Defender v4.18.2108.7 * Malwarebytes Premium v4.4.7.134-1.0.1464 * MS Office Home and Business 2019 C2R v2108 (build 14326.20404)
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

Edited October 4, 2021 by lmacri

[Roj9]

Thanks

Thanks. Here is the TXT file log. 

The following did not help...

DISABLE the Exploit Protection settings at Settings | Security | Exploit Protection | Advanced Settings | Application Behaviour Protection | Office WMI Abuse Prevention

scan.txt

[lmacri]

Hi Roj9:

Sorry, only Malwarebytes employees and a small group of users with advanced permissions are allowed to open attached files, so you'll have to wait for @AdvancedSetup or one of the other senior members of this forum to review your detection log.

If the Protection Technique that triggered the block for your client was something other than Office WMI Abuse Prevention (I only used that as a example) then disabling Settings | Security | Exploit Protection | Advanced Settings | Application Behaviour Protection | Office WMI Abuse Prevention isn't going to stop the block.
-------------
64-bit Win 10 Pro v21H1 build 19043.1237 * Firefox v92.0.1 * Microsoft Defender v4.18.2108.7 * Malwarebytes Premium v4.4.7.134-1.0.1464 * MS Office Home and Business 2019 C2R v2108 (build 14326.20404)
Dell Inspiron 15 5584, Intel i5-8265U CPU, 8 GB RAM, Toshiba KBG40ZNS256G 256 GB NVMe SSD, Intel UHD Graphics 620

[Porthos]

22 minutes ago, Roj9 said:

Thanks

Thanks. Here is the TXT file log. 

The following did not help...

DISABLE the Exploit Protection settings at Settings | Security | Exploit Protection | Advanced Settings | Application Behaviour Protection | Office WMI Abuse Prevention

scan.txt 878 B · 0 downloads

Uncheck the following and click apply.

[AdvancedSetup]

Disable the Exploit Protection settings at Settings | Security | Exploit Protection | Advanced Settings | Application Behavior Protection | Office spawning batch command prevention