About mski7861

mski7861 · 04-09-2024

We have an end user machine that was placed into isolation after a high severity Cloud IOC Event (Cloud IOC: W32.PowershellIEXReplace.ioc) and a low severity Cloud IOC Event (Cloud IOC: W32.PowershellObfuscationAttempt.ioc) was detected. Powershell ...

mski7861 · 02-29-2024

Anyone else using AutoHotkeyU.exe in their environment and experiencing multiple retrospective quarantine events because the file disposition is now malicious? I understand what it does, but I'm curious why the disposition recently changed

mski7861 · 02-27-2024

Can the Cisco Secure Endpoint Secure Client be configured to display threat information when they are detected in the console? I checked off Engine Notification in the policy, advanced settings, client user interface.

mski7861 · 02-01-2024

Setting up a new implementation of Umbrella and the client rolled out the RC to a few Windows 11 laptops that have a MS VPN configured to connect to Azure. After installing the Umbrella RC, they get the following error after entering the username an...

mski7861 · 01-23-2024

Today we are seeing multiple high severity events being generated for wscript.exe sha256: 4173fc5a6864f03ab021823cd0f2f085ba85b3a9b1e37a2094798fc099507523 This is affecting multiple versions of the connector which is causing multiple endpoints to be ...

mski7861 · 04-09-2024

Thank you Roman, I understand the roles of IOCs and appreciate your feedback. I opened a tac case to help investigate this further.

mski7861 · 03-14-2024

Normally when trying to identify if a detection is legitimate or a false positive, you can start with checking the sha against the VirusTotal database and you can search Talos. You can also submit disposition changes for fp's.

mski7861 · 03-01-2024

A little more background: There are a number of users in our organization that have been using AutoHotKey for quite some time, primarily to automate repetitive tasks. Working with a few end users yesterday, I noticed most were running the older ve...

mski7861 · 03-01-2024

@Matthew Franks here are the details: There appears to be at least 3 versions of AutoHotkey.exe in our environment that are triggering threat detection and retrospective quarantine failure events: C:\Program Files\AutoHotkey\AutoHotkeyU32.exe / disp...

mski7861 · 02-27-2024

I'm all about security, however it seems like false positives are happening more often lately. What's worse is we have automated isolation actions configured and when a false positive triggers, it makes for a bad day.

Member Since	‎07-14-2005 08:56 AM
Date Last Visited	‎04-30-2024 07:07 AM
Posts	37
Total Helpful Votes Received	10

User Statistics

User Activity

Isolated host generating multiple Expolit Prevention events

AutoHotkeyU.exe disposition is now malicious

Configure the SEP to display messages when a threat is detected

After installing Umbrella RC on a Win11 laptop, MS VPN no longer works

Multiple false positive events for wscript.exe

Re: Isolated host generating multiple Expolit Prevention events

Re: False positive WAX####.tmp Amp detection?

Re: AutoHotkeyU.exe disposition is now malicious

Re: AutoHotkeyU.exe disposition is now malicious

Re: System Restore Disabled via Registry