Trend Micro Deep Security reports HEU_AEGIS_CRYPT error when opening DI API connection

[dan_jordan]

I have a client who uses SAP Business One for HANA, running version 10 SP 2308. I am developing a .NET console application for them using the DI API. When I try to connect to their company, Trend Micro Deep Security shuts the application down immediately and reports a HEU_AEGIS_CRYPT malicious behavior. 

According to their web site, Trend Micro says that HEU_AEGIS_CRYPT detection occurs when “an application attempts to make changes to numerous files in a short time.”

I presume that this is being done by DI API, because all the application is doing at this point is connecting to a company database via DI API.

Where is DI API trying to create these files, so I can tell the client where to add an exception in Trend Micro? 

Thanks,
Dan

[dan_jordan · Accepted solution]

I figured out the reason that Trend Micro was flagging my new application as malware with the HEU_AEGIS_CRYPT event. Apparently this only seems to happen with a console application and not with a Windows GUI application. 

The default configuration for DI API involves generating log files under the %ProgramData%\SAP\SAP Business One\Log\SAP Business One\ directory. DI API starts writing these log files when you open a connection to an SAP company database. Apparently enough of these files are generated to convince Trend Micro’s behavior detection that you’re running some sort of ransomware.

I temporarily disabled DI API logging on the server where I had the new application running using the instructions in SAP Note 3406982. I backed up the b1LogConfig.xml file in the C:\Program Files\SAP\SAP Business One DI API\Conf directory and replaced it with the contents described in that note. 

If Trend Micro can be configured to exclude the %ProgramData%\SAP\SAP Business One\Log\SAP Business One\ directory, then Trend Micro shouldn’t be shutting down this application. 

The client has now added an exclusion for this directory. 

[Johan_Hakkesteegt]

Hi Dan,

Is it not possible to just add an exception for the DI API in general?

Regards,

Johan