Hi,
We're running a forticlientems (7.01) and have a number of versions of forticlient installed at our company.
When we upgrade forticlient to 6.4.6 and 7.01 we get real time protection warnings like these,
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
as well as for chrome.
This is on managed windows 10 computers and we can't find anything on them that we think should trigger this?
Anyone has any ideas on how to fix this or how the find out exactly what is causing the problem?
Thanks in advance!
Kenth
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
AntiExploit is a new feature in FortiClient that works by detecting abnormal process spawn behaviors (such as a virus starting running commands in the background, or, more common, a browser process spawning powershell or cmd processes).
For remediation of this behavior (when unwanted), it is already in work Antiexploit exceptions option for future releases of EMS and FortiClient, expected in FortiClient 7.0.3 (not binding or confirmed).
Current workaround (to stop generating these messages) is to disable the "Anti-Exploit" feature (which also disables the feature for other programs as well and limits the protection)
Internal reference: 713557 / 688725
AntiExploit is a new feature in FortiClient that works by detecting abnormal process spawn behaviors (such as a virus starting running commands in the background, or, more common, a browser process spawning powershell or cmd processes).
For remediation of this behavior (when unwanted), it is already in work Antiexploit exceptions option for future releases of EMS and FortiClient, expected in FortiClient 7.0.3 (not binding or confirmed).
Current workaround (to stop generating these messages) is to disable the "Anti-Exploit" feature (which also disables the feature for other programs as well and limits the protection)
Internal reference: 713557 / 688725
Created on 01-05-2023 01:50 PM Edited on 01-06-2023 03:37 AM
Has there been any resolution to this issue aside from turning off Anti-exploit. We're running FC7.0.7, and it's still an issue. We added Chrome and Adobe to the exception list and the only way to solve the issue is to remove the add-on.
Had the same issue. It had to do with extensions. On one computer, it was Acrobat Browser Helper, another it was LastPass; otherwise working on other systems, some also having been updated.
I disabled the Add-In and the problem went away.
I finally (v6.4.8 build 1753) added chrome.exe to the Anti-Exploit exception list, istead of the blanket feature disable.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.