Whitelisted Application routed to the deny_ps sandbox when Critical System Protection (CSP) Intrusion Prevention policy applied

Products

• Critical System Protection

Issue/Introduction

The customer reported an issue where the whitelisted process was routed to the deny_ps sandbox instead of the assigned sandbox from the Application Rule. 

Environment

Win10

CSP 8.0.x

Cause

This issue can occur when Block Execution of Unsigned Binaries is enabled in the Global Policy Options. 

 

 

Resolution

Global Policy Options take precedence over the Application Rules

If this option is enabled, and you attempt to launch an unsigned binary additional exception is required in the section below: