05-02-2025 04:04 AM
From the logs, I see that the load of 'procexp.sys' was blocked by XDR. The BTP rule that blocked this activity was introduced in CU 640 aims to protect our agent from a potential vulnerability that could be exploited by the "procexp.sys" driver. When used maliciously, this driver's kernel functions could pose a risk to our agent. As a precaution, when this driver is being loaded by any application, the agent will prevent its loading but will allow the application itself to run (the source process will not be terminated).
The "procexp.sys" driver is commonly associated with tools like "Process Explorer" (procexp.exe). The driver is loaded when these applications are executed with administrative privileges, triggering an alert..
