This issue is resolved with the ENS 10.7.0 November 2020 Update.
Troubleshooting:
If you continue to see unexpected growth in the folder size, perform the steps below:
- Enable ENS debug logging on the affected system.
- Run an AMTrace and Process Monitor for a few minutes while the folder size is increasing.
For instructions, see KB86691 - Minimum data collection steps for Endpoint Security issues.
- Run the following command from the CLI on the affected system:
dir C:\$mfedeeprem\ /s >> c:\temp\deeprem.txt
- Immediately run a Minimum Escalation Requirements (MER). Once complete, provide the deeprem.txt file (zipped if large), AMTrace log, and Process Monitor log to Technical Support.
Background:
- Any newly started process with a reputation of 50 ("unknown") or lower is monitored for Enhanced Remediation. In addition, any process already running with a reputation that's reduced to 50 or lower as a result of loading an unknown or malicious DLL is subject to monitoring.
- If Enhanced Remediation starts for a process, and no detection by an ATP scanner occurs within 10 minutes, monitoring stops for that process and the mfedeeprem DLL is uninjected. The session details in c:\$mfedeeprem\current_sessions\ are moved to c:\$mfedeeprem\terminated_sessions\.
- Every five minutes of system uptime, the entire contents of c:\$mfedeeprem\terminated_sessions\ are archived to c:\$mfedeeprem\archived_sessions\.
- Any archived sessions that become older than 30 days are automatically deleted.
- To trigger immediate archive of the terminated sessions folder at any time, disable and re-enable ATP.
Testing:
To confirm that Enhanced Remediation is working, run the following commands from the CLI on a test system:
copy c:\windows\system32\calc.exe c:\temp\not_calc.exe
echo "test" >> c:\temp\not_calc.exe
start c:\temp\not_calc.exe
The modified
calc.exe starts, but now with an unknown reputation. You should see a new session GUID created under
\current_sessions\.
If you've enabled ENS ATP debug logging, the
EnhancedRemediation_Debug log should have entries with the session ID and other details associated with the monitoring of
not_calc.exe.
To check for injection of mfedeeprem*.dll:
- Open a Command-line session as Administrator on the host
- Type tasklist /m mfedeep* and press Enter.
For example: Here, the
win32calc process was launched by running the not_calc test file:
Image Name PID Modules
========================= ======== ============================================
win32calc.exe 10080 mfedeeprem64.dll
Exclusions
Add an exclusion for the process path or file name in the assigned on-access scan policy Standard risk exclusions. This exclusion also prevents the associated Enhanced Remediation DLL from injecting the process.
- If you are a registered user, type your User ID and Password, and then click Log In.
- If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.
