Guest User!

You are not Sophos Staff.

Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 26 subscribers
  • Views 11109 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG IPS rule dropping Windows 10 Upgrade assistant packets

PGP

Hi Guys,

I'm trying to update couple of windows 7 pro machines to Windows 10 using windows 10 upgrade assistance. However the traffic being dropped by IPS rule LAN--> WAN. Below is what I see in logs.

Time - 2017-05-09 09:53:01
Log Comp - Anomaly
Action - Drop
Source IP - 10.1.0.26 :TCP(53500)
Destination IP - 13.107.4.50 :TCP(80)
Signature ID - 1131031030
Signature Name - Malware Trojan-Downloader.Win32.Molelash.A Runtime Detection
Category - Malware Communication
Platform - Windows
Target - Client
Firewall Rule - 2
Message ID - 06002

 

Is there a way to add a custom IPS rule to allow traffic?

Thank you.



This thread was automatically locked due to age.
Parents Reply
  • 0 in reply to lferrara

    Hi Luk,

    If I allow Malware Trojan-Downloader.Win32.Molelash.A Runtime Detection matching signature, isn't that mean I could be allowing anything that matches this same signature rule? not only windows 10 upgrade assistant traffic?

    Thank you for your help.

Children
  • +1 in reply to PGP

    Unfortunately yes, until snorts fixes the issue.

    Signature based IPS are subjected to false-positive...Open a ticket with Sophos Support in order to communicate the issue.

    In the meanwhile, if you need Windows 10 Upgrade Assistant allowed, create a temporary firewall rule that you enable as needed.

    Regards

  • 0 in reply to lferrara

    Thanks Luk. I have contacted Sophos and awaiting their reply. I have been doing temporary firewall rule option whenever I need to use the windows 10 upgrade. However, just a workaround would be good to have a solution.