ExploitPayloadfileBlocked on system

[Phoenix84]

Same for me, I'm a developer and the anti-exploit triggered on a powershell script I wrote a while ago.

It's part of a build process, the entire package, including my script are on Github here:

 https://github.com/Gwindalmir/SEWorkshopTool

 

The powershell script in question checks to see if a game is installed from Steam, and if so, creates a junction in the build path pointing to where the game's binaries are. If the game isn't installed, it uses another tool to download the dedicated server binaries, which are free, and extracts them to the build location instead. These binaries are a build-time dependency. I use the same script in Github Actions to perform auto-builds.

I can see why it might be flagged, since it's downloading and running stuff from the internet.

I had to disable Ransomware protection shortly after it was added to MB because it's incompatible with Visual Studio (triggers during a build and blocks the compiler). I don't want to have to disable exploit protection too.

psh_false_positive.txt LinkBinaries.ps1.txt

Edited September 5, 2023 by AdvancedSetup
Disabled hyperlink

[AdvancedSetup]

Good day @Phoenix84

Can you please get us the following logs so that I can submit this to our Dev Team

 

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

• Download the Malwarebytes Support Tool
• In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
• In the User Account Control pop-up window, click Yes to continue the installation
• Run the MBST Support Tool
• In the left navigation pane of the Malwarebytes Support Tool, click Advanced
• In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
• A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply

Thank you

 

[Porthos]

The beta that was released today has the anti-exploit fix included.

You may get the beta by enabling BETA updates and checking for updates.

This is the version with the fix.