HP Thunderbolt Dock G4 Firmware triggers Defender ASR rule block

[ParHagman]

Hi HP and all,

I have recently encountered a block from Microsoft Defender ASR rules affecting HP Thunderbolt Dock G4 Firmware Installer, see image below:

Defender for Endpoint information:

• App or process blocked: WmiPrvSE.exe
• Blocked by: Attack surface reduction
• Rule: Block process creations originating from PSExec and WMI commands
• Affected items: C:\Program Files\HP\HP Firmware Installer\HP Thunderbolt Dock G4\HPFirmwareInstaller.exe

The HPFirmwareinstaller.exe is not related to a critical function for the computer but it is quite good to have the opportunity to make firmware updates for the docking station when new drivers becomes available.

The end user will be prompted by Defender for Endpoint that a process is blocked and this generates unnecessary  calls to the ServiceDesk 

Now when more and more companies are moving to cloud managed computers,  ASR rules are becoming a very important part of the overall security requirements.

On the wishlist is that HP takes a look inside the code of the HP Thunderbolt Dock G4 Firmware Installer and make necessary changes to make it compliant with Microsoft's available security standards for the Attack Surface Reduction feature.

General Microsoft references for Attack Surface Reduction:
https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference 

https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#microso...

Blocking rule specific documentation:
https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#block-p...

Best Regards

Par Hagman

Malmoe, Sweden