SES Adaptive Protection rules do not block some processes when the file is renamed.

Products

• Endpoint Security Complete

Issue/Introduction

Typically, when setting an adaptive rule to block or log a process launch, the block will happen regardless of the filename.
However, sometimes this does not happen.

Cause

The reason some processes are not blocked when the file on disk is renamed is that these processes lack the original filename value in the PE file version information.

This is quite rare for a legitimate software not to have this field populated, but it does happen. For example Anydesk will not be blocked when the file is renamed to something other than Anydesk.exe because it does not have the Oriiginal Filename value.

This property can be checked with a simple Powershell command like this:

PS C:\Users\###> (Get-Item "C:\Program Files\Google\Chrome\Application\Chrome.exe").VersionInfo.OriginalFilename
chrome.exe
PS C:\Users\###> (Get-Item C:\Users\###\AnyDesk.exe).VersionInfo.OriginalFilename

PS C:\Users\###> (Get-Item C:\Windows\System32\msiexec.exe).VersionInfo.OriginalFilename
msiexec.exe.mui

 

Resolution

This is working as intended, in scenarios where the processes need to be blocked regardless of the filename but they do not have the OriginalFilename value populated, then other means of blocking should be used (Deny List, Firewall rules etc)