Hi,
I have an application created using VMware ThinnApp. Something like a portable application.
The last few days I have been getting the application blocked on HollowProcess.
Unfortunately the application is quite important for me and I need to run it, but even if I put it in exceptions it doesn't work.
It doesn't work even if I shut down the whole Endpoint.
Has anyone had the same experience?
best regards
Michal
Hi Michal Talman CZ ,
Thank you for reaching out to the Sophos Community Forum.
We'll have to check the detection details, can you share that here, please? If you have any screenshots, that would also help. May I also know what are the exclusions you've added for this detection?
Yes, of course.
This behavior occurred just a few days ago.
If you want, I can send you the app.
Based on the type of detection that was raised, you will need to create an Exploit Mitigation Exclusion. You can find more information on how to do this in the following article.
- Exploit mitigation exclusions
I suggest checking the "Details" button as shown in the screenshot below, as this will typically contain more information on the detection. You can also create the exclusion from the UI that opens.
