Reply to thread

Message

<blockquote data-quote="Digmor Crusher" data-source="post: 1105963" data-attributes="member: 69540">I keep getting this block now Andy, anything to worry about? I assume its because I&#039;m using the Interactive setting? Thanks.Event[0]:Time Created&nbsp; : 2024-10-25 7:46:09 AMProviderName : Microsoft-Windows-Windows DefenderId&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; : 1121Message&nbsp; &nbsp; &nbsp; : Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; For more information please contact your IT administrator.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ConfigureDefender option: Block credential stealing from the Windows local security authority subsystem (lsass.exe)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Detection time: 2024-10-25T12:46:09.878Z&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; User: NT AUTHORITY\SYSTEM&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Path: C:\Windows\System32\taskhostw.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Process Name: C:\Windows\System32\lsass.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Target Commandline: taskhostw.exe -RegisterDevice -SettingChange&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Parent Commandline:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Involved File:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Inheritance Flags: 0x00000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Security intelligence Version: 1.419.704.0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Engine Version: 1.1.24080.9&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Product Version: 4.18.24080.9</blockquote>

[QUOTE="Digmor Crusher, post: 1105963, member: 69540"] I keep getting this block now Andy, anything to worry about? I assume its because I'm using the Interactive setting? Thanks. Event[0]: Time Created : 2024-10-25 7:46:09 AM ProviderName : Microsoft-Windows-Windows Defender Id : 1121 Message : Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator. For more information please contact your IT administrator. ID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 ConfigureDefender option: Block credential stealing from the Windows local security authority subsystem (lsass.exe) Detection time: 2024-10-25T12:46:09.878Z User: NT AUTHORITY\SYSTEM Path: C:\Windows\System32\taskhostw.exe Process Name: C:\Windows\System32\lsass.exe Target Commandline: taskhostw.exe -RegisterDevice -SettingChange Parent Commandline: Involved File: Inheritance Flags: 0x00000000 Security intelligence Version: 1.419.704.0 Engine Version: 1.1.24080.9 Product Version: 4.18.24080.9 [/QUOTE]

Verification