After update to Forticlient 6.4.6 and 7.0.1, malware real time protection goes wild

[Kenth]

Hi,

We're running a forticlientems (7.01) and have a number of versions of forticlient installed at our company.

When we upgrade forticlient to 6.4.6 and 7.01 we get real time protection warnings like these,

Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

as well as for chrome.

This is on managed windows 10 computers and we can't find anything on them that we think should trigger this?

Anyone has any ideas on how to fix this or how the find out exactly what is causing the problem?

Thanks in advance!

Kenth

[AlexC-FTNT · Accepted solution]

AntiExploit is a new feature in FortiClient that works by detecting abnormal process spawn behaviors (such as a virus starting running commands in the background, or, more common, a browser process spawning powershell or cmd processes).
For remediation of this behavior (when unwanted), it is already in work Antiexploit exceptions option for future releases of EMS and FortiClient, expected in FortiClient 7.0.3 (not binding or confirmed).
Current workaround (to stop generating these messages) is to disable the "Anti-Exploit" feature (which also disables the feature for other programs as well and limits the protection)

Internal reference: 713557 / 688725

[weiss-ira]

Has there been any resolution to this issue aside from turning off Anti-exploit.  We're running FC7.0.7, and it's still an issue.  We added Chrome and Adobe to the exception list and the only way to solve the issue is to remove the add-on.

[skolesar]

Had the same issue.   It had to do with extensions.  On one computer, it was Acrobat Browser Helper, another it was LastPass; otherwise working on other systems, some also having been updated.

I disabled the Add-In and the problem went away. 

I finally (v6.4.8 build 1753) added chrome.exe to the Anti-Exploit exception list, istead of the blanket feature disable.