LIVEcommunity - Who Me Too'd this topic

Buy or Renew

For the last few days I've had random machines (some with fresh Windows installs) triggering Cortex alerts when logging into OneDrive.

The alert is Behavioral threat detected (rule: parent_process_spoofing) and the path is the legitimate OneDrive executable at C:\Program Files\Microsoft OneDrive\25.085.0504.0002\OneDriveLauncher.exe.

Has anyone else been seeing this?

Who Me Too'd this topic

L0 Member

Me Too date:

L0 Member

Me Too date:

L0 Member

Me Too date:

L0 Member

Me Too date:

L0 Member

Me Too date:

L0 Member

Me Too date:

L0 Member

Me Too date:

L0 Member

Me Too date:

L1 Bithead

Me Too date:

Unlock your full community experience!

Who Me Too'd this topic

Cortex false positives for OneDriveLauncher.exe?