I have a large .net7 browser-wasm project that is published with AOT (Ahead-of-time) complication and Sophos keeps flagging "C:Program Files\dotnet\dotnet.exe" as a ransomware threat. The AOT process is linking and packaging a large number of files. Is…

How can I add a new custom application to the exceptions? This does not seem to help or it is not clear what will happen with the path that I add manually: I was looking for something like this: Need to add ROP exclusion for this not so…

Hello, intercept-x caught this event, I didn't find any reference. Mal/EncPk-AAI, the detection was in a legitimate program, is this a false positive? Thanks André Soares

uid: 11153a4b-eb17-3ea8-e686-4e277003c638 family_id: 6eb3ff26-0e34-15a1-0f48-11e273784787 process_alias_path: $windows\explorer.exe process_name: Windows Explorer process_version: 10 thumbprint: 20f00333e19359ac81a0ac9dd49f7dd31533f3379a6e57f78bada98b0b7c64cf…

I've whitelisted PSEXEC and I've disabled all the modules for Sophos Endpoint but PSEXEC is still being removed as its recognised as a PUA. I've created a policy to whitelist this app on Central but nothing is applying. Anyone know how to get around…

Hello everyone, I have a problem with eset full disk encryption, in my organization clients have sophos Intercept X Advanced endpoint, and when ı start disk encryption with eset there are alerts by sophos hitman pro that does not permit for encryption…

Hi, I keep receiving this notification on Sophos. So far, I'm running Exchange Server 2019 on VM Host. The error mentioned this path on C drive: inetpub\wwwroot\aspnet_client\nzkqhfcsjpl.aspx . The .aspx name are not consistent. I'm not receiving…

We getting this alert few days ago. Can somebody help me to understand it legit or not? Thank you in advanced. Endpoint Type: Computer OS: Windows Device: HoKahMunNB Ransomware: uid: 0bcd57bb-ee99-4a28-b0d0-ec76291e25f4 family_id: 8f45804d…

Hey there New to Sophos so before i go installing on server running SQL (NOT Clustered) do i need to create any exclusions policies or is intercept x smart enough to do i on its own? if there are policies i need to create can someone guide me through…

We have a print driver that does PDF conversion of your document then uploads to our printshop. Every time someone on a Windows computer uses this driver it is opening an investigation. When I look at the investigation I can see that the print spooler…

Hi, guys Does anybody experience in file recovery that have been cleaned by sophos intercept X, actually I’m working on POC right now and one of my client’s application suspected as PUA, based on our intercept X behaviour, the file will be recover…

How to restore a threat file that has been cleaned up？ （The self-developed program was considered a threat file, so it was cleaned up during the copying process.） How can i restore the file?

Hi I have the same issue as the users in this thread. https://community.sophos.com/community-chat/f/discussions/108211/rop-exploit-prevented-in-microsoft Our users are trying to use a VoIP tool called VoIPOffice Communicator and Sophos is blocking…

There is one client that does nothing else than reporting WipeGuard preventions. Even for Sophos Processes. What's the use of that feature and log? Initial Detection: WIN-MITRE-Behavioral-TA0040-T1561.002

Real Time sanning is (or seems to be) causing major performance issues for our developers when they are creating a project using yarn to assemble the repositories, even if they have cached the files or have them in a local repository. Can the scans be…

We are rolling out Sophos on our servers. One server holds the software repository with company software installers and a lot of tooling for us sysadmins. As one can guess, Sophos detects several PUA's, like Nirsoft apps, TightVNC, a.s.o. We and…

I have a couple of computers that when downloading, it will stay at 100%. will not allow you to open the file/ will not open "Show in folder".... I can go to my downloads page and I can access it and run the download from there. So after so much troubleshooting…

Why would someone want to add the directory %programfiles(x86)%\Sophos\Sophos Anti-Virus\ as an exclusion from scanning for threats in the Threat Protection Policy?

J’a

Is there anything special that needs to be done for Configuration Manager to work with Intercept-X? Some (not all and it changes A LOT) computers aren't seeing deployments in Software Center. Some computers will see 5 one day then all the next. Some will…

we have a desktop users which is installed the intercept x endpoint. now for these user are facing an issue that when they open a specific link the chrome or edge is getting error pages un responsive. when try with another user from the desktop which…

Hi, We have had 2 of these notifications over the past week on two computers days apart. Can somebody please help me to understand this. Many thanks in advance. Endpoint Type : Computer OS : Windows Device : …

Does sophos protect mapped drives on endpoints?

Good afternoon I use SyncBackFree, it creates a temporary file. It is detecting it as a virus I've been looking for documentation on Troj/DrodZp-CB and I can't find any documentation. Has something similar happened to you?

Hi I would like to know about SoPhos process information. Please tell us in detail what function the two processes below perform. 1. SoPhosFilesScanner.exe 2. SSPService.exe