Sophos found threat

[dadep]

Hello,
my Sophos endpoint found following threat

Disrupt_2a (T1574.002) found in C:\XYplorer\XYplorer.exe

for the Sophos KB:
"The "Disrupt" detections are related to our Adaptive Attack Protection. These typically indicate an active, hands-on attack within your environment. Please see the knowledgebase article at https://support.sophos.com/support/s/ar ... uage=en_US and take immediate action".

For now I've disable Adaptive Attack Protection and set the exclusion for C:\XYplorer folder.

Can you investigate about this ?
thanks in advance
Best regards
Davide

[Horst]

What should the Author investigate here ?
It's normal behavior of all Anti-Virus tools to produce false positives.
They will learn over the time and adapt the signatures.
As you already did, make an exception for XY.
Send your exe to Virus-Total and see what the detections are.
https://www.virustotal.com/gui/home/upload
That's the current results, which also includes Sophos.

Screenshot - 04.06.2024 , 10_40_51.png (41.9 KiB) Viewed 498 times