We have a few users that have Microsoft Power Query for Excel installed. Whenever they enabled the add-in it crashes Excel. If we disable Sophos Intercept it works just fine. I can't seem to find where I can whitelist this COM Add-In. Any ideas? Sophos continually flags this in RCA as 'Exploit CallerCheck'.
I have this same problem. When I try to launch Power Query and connect to my SQL server from Excel 2013 the application closes and I get an alert from Sophos. This disrupts some of our employees who are trying to run reports using our Company Data-cubes in SQL.
Then Excel closes immediately and I get this:
This is my installation:
Sorry I should have said one more thing!
If I use the following work-around it allows me to connect to the SQL database, but this is not a good solution because it requires using TAMPER passwords to alter the installation. We cannot distribute these passwords to the users...
Hey Leo and Stephen!
Out of interest, have you both tried setting an exclusion for this specific exploit detection in your Threat Protection policy? Some plugins can do things in memory which look quite similar to exploitative malware. While I do recommend you minimise making any exceptions in a policy (and if you do, make periodic checks to confirm whether the exceptions are still necessary), sometimes exceptions have to be made.
In the event you've not tried this, I've slapped together a quick screenshot showing an exploit detection in a specific application (here, Internet Explorer) being excluded in a Threat Protection policy.
Hi SecBug
I have put a Scanning Exclusion in place, which does not fix the issue.
As I said I do have a ticket open with support, they've sent me a test build (hasn't fixed the issue) and asked for some SDU logs.
One thing that does work is adding Excel in the Exploit Mitigation Exclusion.
Given that a lot of viruses are spread through Excel macros this isn't a brilliant solution, also this option is only available as a Global system setting and not as a Policy setting I could apply only to certain users to reduce the risk slightly?
