Microsoft Photos.exe

J.Indoc — Thu, 05 Feb 2026 15:55:56 GMT

Hi,

Does anyone experience receiving alerts from photos.exe due to "Suspicious File Modification" and the Module is "Anti-Ransomware Protection" even the program is legitimate?
Other factors I'm seeing is due to possibly outdated version of the said program. *See attached reference photo*

I'm hoping from anyone's advice from other members with the same experience on how you handle this issue and some pointers on how to resolve it.

Cheers!

Re: Microsoft Photos.exe

susekar — Thu, 05 Feb 2026 16:19:00 GMT

Hello @J.Indoc ,

Greetings for the day.

Yes, this is a known behavior where the legitimate Microsoft Photos.exe process triggers “Suspicious File Modification” alerts within the Anti-Ransomware Protection module. These alerts are typically false positives caused by the application interacting with decoy files created by the Cortex XDR agent.

Root Cause Analysis

Decoy (Honeypot) Files

The Anti-Ransomware module places hidden decoy files (often starting with ZZZZZ or !!!!!) in various directories to detect encryption attempts.

Application Behavior

Applications like the Windows Photos app often scan, index, or perform cleanup operations on directories where these decoys reside. When Photos.exe modifies or even enumerates these protected files, the agent may interpret this behavior as potential ransomware activity and generate an alert.

Aggressive Mode

These alerts are most frequent when the Ransomware Protection module is set to Aggressive mode. In this mode, the agent places more decoy files in user-accessible locations, increasing the likelihood that benign applications will interact with them.

Recommended Resolutions

1. Revert to Normal Protection Mode (Standard Fix)

The most common way to resolve these false positives is to change the protection mode from Aggressive to Normal in the Malware Security Profile. Normal mode maintains strong protection while reducing exposure of decoy files to benign processes.

Steps:

Navigate to Endpoints → Policy Management → Prevention → Profiles
Edit the Malware Security Profile assigned to the affected endpoints
Locate the Anti-Ransomware Protection section
Change Protection Mode from Aggressive to Normal
Save the profile and ensure it is applied to the relevant policy rules

2. Create a Process Exception

If Aggressive mode must remain enabled, you can create a targeted exception for Photos.exe to prevent it from being monitored by the Anti-Ransomware module.

Steps:

Go to Settings → Exception Configurations → Legacy Agent Exceptions
Click + Add Rule and select the appropriate platform (Windows)
Select Process Exceptions as the module type
In Target Properties, enter the process name: photos.exe
In Module Name, select Anti-Ransomware Protection and add it
Define the scope (Global or specific Profiles) and click Create

3. Hash Exception

Alternatively, you can add the specific file hash of the legitimate Photos.exe binary to the Allow List (Hash Exceptions). This approach is useful if the behavior is isolated to a specific version of the executable.

Verification

You can confirm that the alert was triggered by decoy file interaction by reviewing the alert data dump. Indicators typically include file paths similar to:

C:\ProgramData\Cyvera\Ransomware\...\ZZZZZ.doc
C:\Users\<user>\Pictures\!!!!!.jpg

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

Re: Microsoft Photos.exe

J.Indoc — Mon, 09 Feb 2026 16:59:06 GMT

Hi, @susekar,
Thank you for your insights in my concern. All recommended methods are all working.

topic Re: Microsoft Photos.exe in Cortex XDR Discussions

Microsoft Photos.exe

Re: Microsoft Photos.exe

Root Cause Analysis

Decoy (Honeypot) Files

Application Behavior

Aggressive Mode

Recommended Resolutions

1. Revert to Normal Protection Mode (Standard Fix)

2. Create a Process Exception

3. Hash Exception

Verification

Re: Microsoft Photos.exe