Endpoint Protection

How should I list this so that it is blocked across the board?

C:\Windows\Temp\CC11A3.tmp>>Court_Notice_Jones_Day_Wa#4716.zip>>Court_Notice_Jones_Day_Washington.exe

Here is a screen shot

C:\Windows\Temp\*

Informative stuff here:

http://www.symantec.com/docs/TECH131741

thats not the path

you can give it as c:\windows\temp\yourfilename*.exe or *.exe

That filename is very bizarre

If you need to have a legit file run than you need to know it's name and can set it in the exclude process section.

The doc I linked explains it very well :)

All I want to do is block this one file

CC11A3.tmp>>Court_Notice_Jones_Day_Wa#4716.zip>>Court_Notice_Jones_Day_Washington.exe

I do not want to block an entire directory because there may be other files that have legitimate functionality.

It's hard to pinpoint legitimate files because different installationsm result in different files. Blocking and entire directory seems like it would be more of a hassle.

Rafeeq? Like so?

c:\windows\temp\CC11A3.tmp>>Court_Notice_Jones_Day_Wa#4716.zip>>Court_Notice_Jones_Day_Washington*.exe

In the policy, under the "Apply to the following processes" section, add only that file name.

Court_Notice_Jones_Day_Washington.exe

It should than only apply to this process.

Than add C:\Windows\Temp\

That's what I needed. Thank you again!!!!

not sure where you got that path from , as its in temp folder

all you need to do is 

C:\windows\temp\*\Filename.exe

\*\ means any folder below the temp folder

No worries mój przyjaciel

SEPM showed it like below

The Filename starts at CC11A3-----

C:\Windows\Temp\

CC11A3.tmp>>Court_Notice_Jones_Day_Wa#4716.zip>>Court_Notice_Jones_Day_Washington.exe

I tried to add below, and it still won't accept it

C:\windows\temp\*\CC11A3.tmp>>Court_Notice_Jones_Day_Wa#4716.zip>>Court_Notice_Jones_Day_Washington.exe

Try adding for Court*.exe

Shorten it up, I don't think the "_" is allowed

Only wildcards accepted are % and * and ?

C:\windows\temp\Court*.exe

That worked too!!!

Ideally, you want to just block all file execution in that directory and add exclusions as needed. I find it funny that this is a well known malware directory yet even legit processes use it. I get it but time to look at doing something different.

Agreed!!!