ROP exploit Prevented in Microsoft outlook

Hi Craig,

Which version of Sophos AV are you using? What do you see under the events in the Sophos AV dashboard?

For me also has the same issue , the details of the Sophos are listed below 

Endpoint adavanced 10.8.1.2

Sophos Intercept x 2.0.3

Hi Ashok, 

Please open Sophos AV and click on Events Tab, do check if you see any events recorded regarding the issue you are facing.

Hi  Haridoss ,

Kindly view the attached file for your reference 

Hi Ashok, 

Please check if you have any add-ons. Also, check the Application event under the Event Viewer, look for 911 call and look for any application other than MS Outlook.  If even viewer was not helpful, you can use the PROCMON tool, RUN PROCMON - OPEN APPLICATION- Event triggered > Stop PROCMON. Check what process has accessed this file.

Hi Ashok, 

Please check if you have any add-ons. Also, check the Application event under the Event Viewer, look for 911 call and look for any application other than MS Outlook.  If even viewer was not helpful, you can use the PROCMON tool, RUN PROCMON - OPEN APPLICATION- Event triggered > Stop PROCMON. Check what process has accessed this file.