Exploit Prevention Content Version 12789 Causes MSI Installers to Fail

Technical Articles ID: KB96486
Last Modified: 2023-04-28 09:05:00 Etc/GMT

Environment

Endpoint Security (ENS) Threat Prevention - all versions

Problem

After you update ENS to EP content version 12789, signed MSI installers fail.
When you view the Exploit Prevention logs, you see no blocks have been recorded.

Cause

While the exact reason is currently undetermined, a new signature (6251) has been added to this content release, which blocks attempts to bypass MarkOfTheWeb by appending invalid digital signatures to MSI files. The new signature is disabled by default, but the hooks necessary to enforce this signature when enabled are a catalyst for MSI installers failing.

Solution

NOTE: Any future product functionality or releases mentioned in the Knowledge Base are intended to outline our general product direction and should not be relied on, either as a commitment, or when making a purchasing decision.

We're continuing to review the root cause, and updates to this article will be supplied as more progress is made.

To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.

Workaround 1

Disable Exploit Prevention as an isolation step to make sure that the issue no longer occurs after installing content version 12789.
If the issue continues after disabling Exploit Prevention, contact Trellix Support and open a new Service Request.

To contact Technical Support, go to the Create a Service Request page and log on to the ServicePortal.

If you are a registered user, type your User ID and Password, and then click Log In.
If you are not a registered user, click Register and complete the fields to have your password and instructions emailed to you.

If disabling Exploit Prevention resolves the issue, use the following workaround while the investigation continues to determine the root cause.

Edit the assigned Exploit Prevention policy.
Within the Application Protection Rules, search for Install.
Edit the Microsoft Installer rule and set the rule to Exclude. Alternatively, disable the rule.
Save and enforce the policy.

Workaround 2

An out-of-band content release has been provided to work around the issue while investigiation continues on the root cause. The content version is 10.6.0.12892 and is available as of April 26th, 2023 for download in On-Prem ePO, as well as ePO SaaS.

The new content can be manually downloaded.

NOTE: After updating to the out-of-band content version, signature 6251 still appears within the policy configuration for Exploit Prevention. The out-of-band content removes the signature from the content files loaded by Exploit Prevention. The existence of the signature appearing within the policy has no affect on product functionality.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Exploit Prevention Content Version 12789 Causes MSI Installers to Fail

Environment

Problem

Cause

Solution

Workaround 1

Workaround 2

Affected Products

Languages:

Title

Title

Knowledge Center

Exploit Prevention Content Version 12789 Causes MSI Installers to Fail

Environment

Problem

Cause

Solution

Workaround 1

Workaround 2

Affected Products

Languages:

Choose your region

Title

Title