MW blocks opening LibreOffice due to RTP exploit; can't add to allow list

[Carson70]

Log Details-
Protection Event Date: 9/15/22
Protection Event Time: 3:45 PM
Log File: 4ef185e8-3537-11ed-8d83-f8bc12754426.json

-Software Information-
Version: 4.5.14.210
Components Version: 1.0.1751
Update Package Version: 1.0.60101
License: Premium

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Malware.Exploit.Agent.Generic, C:\Windows\system32\cmd.exe \c ver, Blocked, 0, 392684, 0.0.0, , 

-Exploit Data-
Affected Application: LibreOffice
Protection Layer: Application Behavior Protection
Protection Technique: Exploit Office spawning batch command blocked
File Name: C:\Windows\system32\cmd.exe \c ver
URL: 

(end)

RTP exploit block occurs when opening LO from desktop shortcut, any *exe in program folder [e.g., sdraw.exe] or trying to open from a any file that LO can handle

What I tried:

• Add previously detected exploit,,, - nothing appears in add list [ Hash + Application ]
• add exclusion for Libre Office program folder - succeeds but doesn't stop RTP exploit block
• add exclusion for Libre Office under allow app to connect to internet but doesn't stop RTP exploit block
• turning of Exploit Protection temporarily to open LO stops block but is the least ideal solution.

Appreciate any helpful ideas to solve...

 

[AdvancedSetup]

To begin, please do the following so that we may take a closer look.

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to your desktop, please upload that file on your next reply

Thank you

 

[Carson70]

Attached is support tool logs

Since original post I have turned on RTP Exploit protection but turned off  protection for LibreOffice under Manage Protected Applications - a more restricted setting that allows me to use LO w/o compromising general RTP Exploit.

mbst-grab-results.zip

[Porthos]

1 hour ago, Carson70 said:

RTP exploit block occurs when opening LO from desktop shortcut, any *exe in program folder [e.g., sdraw.exe] or trying to open from a any file that LO can handle

Uncheck the following in the advanced exploit settings.

[Carson70]

@Porthos

Thanks for the suggestion. Turned on LO program protection & followed your suggestion in adv settings. Have access w/o blocking.

Was aware of these advanced settings but I am not knowledgeable enough to use them w/o guidance from expert.

C