Exclude Threat Detection "TA0005 - Defense Evasion"

Hi Colsam,

Thanks for reaching out to the Sophos Community Forum. 

Allow me some time to inquire with our team regarding your question and I'll update you here. 

The exclusions in Threat Protection policy will not suppress EDR/XDR detections. We expect to allow customer suppression of detections in the first quarter of the new year. (As always, roadmaps are subject to change.) In the meantime, I will pass this info along to our detections team to determine whether a global suppression or change to the rule is warranted in this case.

That's a tough one -- as certutil is often used for evil purposes (I understand, not in your case) --- question about your backups -- is this a SAP native app for backup that is calling certutil, a script you (or someone else wrote), or a commercial backup application, that is leveraging certutil?  Just curious so I can keep an eye out for it as a MSP.

I see it is using certutil to encrypt / decrypt what looks like the password for the backup to complete... I have seen some customers with custom powershell scripts that decode / encode things in base64 trigger events too.

You're right, we use certutil do encrypt / decrypt the password for the backup. I'll wait for the feature to suppress EDR/XDR detections.

Thanks for your replies.

Thank you, I'll wait for this new feature.