[Bug] Adversary File Alerts not generating with executing respective files

[arvindersingh-qasource]

Describe the bug Adversary File Alerts not generating with executing respective files

Build Details

Web link : https://34.42.103.232/  
Version : smp-dev-3-50-0-20ab71a-1084
Sensor : 3.64.4

Browser Details This issue is occurring on all browsers.

Preconditions

1. NIN3 SMP3.50 must be available.
2. Alert files must be available on endpoint.

Steps to Reproduce

1. RDP to Endpoint.
2. Execute the respective Alert File.
3. Navigate to SMP.
4. Observe that respective Alert is not generated over SMP.

Type of Alerts

• Unusual Process ExecutiON Path - WBEM

  • unusual_process_path.py.txt

• Windows File Masquerading

  • process_name_masquerade.py.txt

• Incoming DCOM Lateral Movement with MMC

  • dcom_lateral_movement_with_mmc.py.txt

• DLL Search Order Hijack Attack

  • uac_sysprep.py.txt

• Bypass UAC via Sdclt

  • uac_sdclt.py.txt

• Activity timeline on updating Permission theft protection in implemented policy

  • tokentheft64.exe.txt

Actual Result Adversary File Alerts not generating with executing respective files

Expected Result Adversary File Alerts should be generating with executing respective files or provide any work around to generate the above mentioned Alerts.

[muskangulati-qasource]

Reviewed and assigned to @charlie-pichette !!

[charlie-pichette]

@brokensound77 is this something your team handles?