{"id":24152,"date":"2022-04-21T01:09:32","date_gmt":"2022-04-20T23:09:32","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=24152"},"modified":"2022-04-21T01:16:22","modified_gmt":"2022-04-20T23:16:22","slug":"microsofts-defender-bemkelt-google-chrome-updates-als-malware-april-2022","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2022\/04\/21\/microsofts-defender-bemkelt-google-chrome-updates-als-malware-april-2022\/","title":{"rendered":"Microsofts Defender flags Google Chrome Updates falsely as malicious (April 20, 2022)"},"content":{"rendered":"

\"Sicherheit[German<\/a>]Microsoft's Defender for Endpoint<\/a> (an enterprise security platform, see Got lost in Defender? There is something like a Defender Cheat Sheet available<\/a>) seems to have run a bit amok once again. Administrators reported that since April 20, 2022, Defender has suddenly deemed updates for the Google Chrome browser as malicious and quarantined them. <\/p>\n

<\/p>\n

\"\"The first reports can be found on Twitter<\/a>, for example, where Kevin Gray informs Microsoft that Microsoft Defender for Endpoint is currently running amok.<\/p>\n

\"Defender<\/a><\/p>\n

There are also reports on Reddit.com that confirm this erratic behavior of Microsoft Defender for Endpoint. For example, this post<\/a> states:<\/p>\n

\n

Defender EPP Blowing Up on Google Updater?<\/p>\n

UPDATE: It does appear to be a false positive, likely triggered by a .dll being unsigned in the latest Google Updater service. <\/p>\n

Just starting to see EPP hit on suspicious services, however all these seem to be legitimate updating operating on Google applications.<\/p>\n<\/blockquote>\n

Defender detects a file goopdate.dll or the associated service as malicious and blocks it. The problem is confirmed by other users in the thread. More threads from April 20 can be found here on reddit.com<\/a> and on Twitter<\/a>. Affected users will receive a warning: <\/p>\n

\n

Multi-stage incident involving Execution & Defense evasion<\/p>\n<\/blockquote>\n

Microsoft was informed about the false alarm via the above-mentioned tweets. The colleagues from Bleeping Computer picked up on the whole thing in this article<\/a> and write that Microsoft has already fixed the problems. A Microsoft spokesperson is quoted in the article:<\/p>\n

\n

We have determined that these are false positives and have updated the logic for this alert to address the issue, which some customers may have experienced.<\/p>\n<\/blockquote>\n

This is not the first case of false positives by Defender (see also links at the end of the article). The Bleeping Computer article also cites several past examples. Anyone from the blog's readership who was affected by this false alarm?<\/p>\n

Similar articles:
<\/strong>Microsoft Defender falsely detected Office updates as ransomware activity (03\/16\/2022)<\/a>
Microsoft Defender falsely reports Trojans on Dell computers (March 2, 2022)<\/a>
Defender signatures cause extreme RAM usage (April 2022)<\/a>
Microsoft warns of (fixed) Defender spoofing vulnerability<\/a>
Windows 10: Unwanted reboots due to Microsoft Defender Application Control (WDAC)<\/a>
Microsoft probably secretly fixes vulnerability in Defender under Windows<\/a>
Windows Defender: Fixes, Issues and Log4j scanner false alarms<\/a>
Microsoft Defender Version 1.353.1874.0 version 1.353.1874.0 incorrectly reports Emotet<\/a>
Got lost in Defender? There is something like a Defender Cheat Sheet available<\/a>!<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

[German]Microsoft's Defender for Endpoint (an enterprise security platform, see Got lost in Defender? There is something like a Defender Cheat Sheet available) seems to have run a bit amok once again. Administrators reported that since April 20, 2022, Defender has … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580],"tags":[780,773],"class_list":["post-24152","post","type-post","status-publish","format-standard","hentry","category-security","tag-chrome","tag-defender"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/24152","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=24152"}],"version-history":[{"count":0,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/24152\/revisions"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=24152"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=24152"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=24152"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}