ok I downloaded the leak test application to test our HIPS application Stormshield. I started to run the clt.exe and stormshield noticed it and said it was trying to elevate it privlieges and blocked the elevation, the program continued to run and finished with a score of 190/???. I got distracted by another in the office and did not see the additional alerts come in stating that now conhost.exe and consent.exe were trying to attach themselves to various running processes. I then tried to go into the registry and then into a elevated cmd prompt… I was denied, I had been in the elevated cmd prompt before the testing. We decided to disable the nic, change my domain password and shut down the server. Have you ever heard of this?? I got the test app from
I am also contacting Stormshield to see if your test caused the agent to freak out. I had reboot the machine to see if that was the case… but the alerts still kept coming in.