PSEXEC exclusions

Hi Abhijeet Nawale 

As it is being detected as Adware, the AV scanner is catching the file. It is not possible to exclude an application and then get an alert for it as well. This is as the AV will not scan the application when it is excluded. So it is not possible to get an alert for excluded applications as it defeats the purpose of exclusion. This application is not available in the application control list and so it is not possible to specify any alert for this.

Hi Abhijeet Nawale 

As it is being detected as Adware, the AV scanner is catching the file. It is not possible to exclude an application and then get an alert for it as well. This is as the AV will not scan the application when it is excluded. So it is not possible to get an alert for excluded applications as it defeats the purpose of exclusion. This application is not available in the application control list and so it is not possible to specify any alert for this.

Hello Yashraj,

Thanks for the reply.

So that means PSEXEC exclusions only possible through anti-virus policy, and after exception no alert can be configured as well?

Thanks,

Abhijeet

Hi Abhijeet Nawale 

Yes, it is not possible to exclude an application from AV scanning and set an alert/custom alert when it is accessed.

Thanks for confirming.

But I believe even after exception, still sophos detects the event and sends alert via syslog/SIEM that its been authorized if configured, correct?

Hello Abhijeet,

If you put an AV exception in, there will be no event detection as it will be excluded before the need to record.

If users need it but you want to control whom can have it, I would recommend creating two policies wherein PSExec is blocked on the bottom one but has an in-policy exclusion for PSExec in the other. It's a bit more of a management overhead as you have to manage two policies but there is no way around that unfortunately.

Emile