How to reduce Stack Exec detections

Hi Daina,

I suggest checking if the thumbprint (or 'Detection ID') is the same. You can find this in the Windows Event Viewer > Application Event logs. Try filtering by Event ID 911. This will return all of the Intercept X detection events. 

Near the bottom of the details on each of these events, you will see something like this:

     Thumbprint
     e8af5f63e87c0cff320a14bcd22ee467cb7531ec8eb31e7dd95a300b1207c4da

This is a way of recording the specific operations that occurred when the detection was raised. If the alphanumeric value shown is the same each time, we can add one exclusion to white-list that specific behaviour. The following article describes in further detail the options for exclusion from Sophos Central. 
- Stop detecting an exploit

Hi Qoosh,

Unfortunately the thumbprint are different on each of the devices. The process trace are the same but the loaded modules changes. We do not want to stop checking for this detection. So turning off the exploit mitigation for stack exec is not an option. 

If the thumbprint is specific to each device, adding the exclusion for each device may be an option, but it sounds like this is changing every time. 

I'd suggest trying the hotfix package for Intercept X to see if this has any improvements. 
- Exploit Prevention cumulative hotfix

Turning off stack exec for Office 2016 may be the only option, but I'd suggest opening a case with our support team to see if anything further can be done to mitigate this.

If the thumbprint is specific to each device, adding the exclusion for each device may be an option, but it sounds like this is changing every time. 

I'd suggest trying the hotfix package for Intercept X to see if this has any improvements. 
- Exploit Prevention cumulative hotfix

Turning off stack exec for Office 2016 may be the only option, but I'd suggest opening a case with our support team to see if anything further can be done to mitigate this.