No, it’s about website blocking too.
AVC thinks that blocking domains due to a few malicious pages is not a good idea. I don’t support their opinion personally and some vendors have argued too.
Not all these FPs are on files.
Trend Micro generally causes false positives on files through the AEGIS behavioural monitoring which can be very aggressive in hypersensitive mode (it enables aggressive detections). These detections can target certain memory management mechanisms that have been abused times and times again in fileless attacks.
However the Trend Micro behavioural blocking respects digital signatures and prevalence information, so this is gonna be on some third-grade software that not many people use.
