MECM - rundll32 and Illusion.Jaguar.28.10BA4514.1B.3020200

bolkony

Hi,

We use Microsoft Endpoint Configuration Manager (MECM).

In our Bitdefender Gravity Zone I have enabled "Microsoft Configuration Manager" under "Vendor and product exclusions > Custom".

Last Friday I upgraded our MECM to version 2309.

Since Saturday Bitdefender Gravity Zone has been sending Hyper-Detect-Alerts regarding found malware.

Name of the malware: Illusion.Jaguar.28.10BA4514.1B.3020200

Infected file: rundll32.exe

SHA256 hash: N/A

Command line: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" PolicyAgentProvider.dll,Setup_CheckNamespaces

And:

Command line: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" PolicyAgentEndpoint.dll,Setup_InitializePolicy

Is it necessary to add any "In-policy exclusions"?

(e.g. regarding Configuration Manager folders on clients, like ccmcache, ccm or ccmsetup)

Best regards,

bolkony

Gjoksi

Hello.

Since you need help with business product, @Andrei_S Enterprise (who provides support for business products) could take a look here and help you with the issue.

Also, you can always contact the Bitdefender business support:

https://www.bitdefender.com/business/support/en/71263-85158-contact.html

Regards.