PHP.exe Triggering AV Alerts

Original Question or Issue:

After upgrading FileCloud due to the recent PHP CVE, Microsoft Defender for Servers has started reporting a blocked action every minute.

Environment:

• Product - FileCloud Server
• Version - 23.263.2
• Platform - Windows

Steps to Reproduce:

Error or Log Message:

Defect or Enhancement Number:

Cause:

We have determined this would be expected behaviour given the Defender policy. With Microsoft Defender for Servers, there is a policy for an Attack Surface Reduction rule, "Block executable files from running unless they meet a prevalence, age, or trusted list criteria", which blocks any executable that Microsoft's cloud hasn't yet seen on enough machines or for long enough, signed or not. In 23.263.2 we updated the bundled PHP to 8.4.27, so the php.exe that our cron service (cloudcron.exe) launches is a brand-new file with little reputation yet, which is what trips the rule.

Resolution or Workaround:

Add a per-rule ASR exclusion for C:\xampp\php\php.exe (or the matching path if FileCloud is installed on another drive), only for this rule, so the rest of Defender's protection stays active: https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-overview#file-and-folder-exclusions-for-asr-rules. If node.exe shows the same block, the same applies to C:\xampp\nodejs\node.exe. Our general AV exclusion guidance is here: https://docs.filecloud.com/fcdoc/latest/server/filecloud-administrator-guide/installing-filecloud-server

Notes: