Exploits Blocked: PayloadFileBlock and PayloadProcessBlock

[mgmccoy]

Hello,

We are running Malwarebytes for Teams (v. 4.6.2.281 - just updated today, update package v. 1.0.75463). I just got a series of Exploit.PayloadFileBlock and Exploit.PayloadProcessBlock notices from Malwarebytes. There were four total PayloadFileBocks affecting "cmd.exe": 2 of which were quarantined and 2 were blocked. There were two PayloadProcessBlocks affecing "v MachineGuid": both blocked. It doesn't appear that anything actually got quanantined though as the only thing in there was an old exploit attempt from a year or two ago. So I'm baffled by this as I've not seen it before and Malwarebytes itself doesn't appear to have found any "threats" via scans/quarantines.

I did run a full scan and last file attached is the scan report - no threats detected.

Please let me know if I need to take any additional steps.

Exploit-PayloadFileBlock_CMD-1.txt Exploit-PayloadFileBlock_CMD-2.txt Exploit-PayloadFileBlock_CMD-3.txt Exploit-PayloadFileBlock_CMD-4.txt Exploit-PayloadProcessBlock_v MachineGuid-1.txt Exploit-PayloadProcessBlock_v MachineGuid-2.txt 2023-9-19_Scan Results.txt

[Porthos]

32 minutes ago, mgmccoy said:

So I'm baffled by this as I've not seen it before and Malwarebytes itself doesn't appear to have found any "threats" via scans/quarantines.

Exploit blocks are not something that gets "quarantined" they are just flat blocked.

This is also part of a false positive that a fix will be released in the next 2-3 weeks.

[Porthos]

The beta that was released today has the anti-exploit fix included.

You may get the beta by enabling BETA updates and checking for updates.

This is the version with the fix.