Cortex false positives for OneDriveLauncher.exe?

[JGrover1]

For the last few days I've had random machines (some with fresh Windows installs) triggering Cortex alerts when logging into OneDrive.

The alert is Behavioral threat detected (rule: parent_process_spoofing) and the path is the legitimate OneDrive executable at C:\Program Files\Microsoft OneDrive\25.085.0504.0002\OneDriveLauncher.exe.

Has anyone else been seeing this?

[austin.griffin]

I have also been seeing this, exact same path and version of OneDrive.

[mavega · Accepted solution]

Hi,

Thanks for reaching out LC.

This false positive has already been noticed and is planned to be fixed on next content releases. 

Please test out after next release and if issue still persists open a support ticket to get further analysis on your issue.

If you feel this answered your question please mark as solution. 

Regards,

[D.Moore415468]

I've seen process spoofing incidents on FileCoAuth.exe, OneDriveLauncher.exe, and OneDrive.exe.

[Vijisaga]

Hello,

We are also receiving the same alert, but it's from a different file path. Can you please confirm that this is a false positive? I would like to know why Cortex XDR is blocking it, as it is a legitimate file:

C:\Users\xxx\AppData\Local\Microsoft\OneDrive\25.085.0504.0002\OneDriveLauncher.exe

C:\Users\xxx\AppData\Local\Microsoft\OneDrive\25.085.0504.0002\FileCoAuth.exe

[Karl-Foley]

We've been seeing the same for the last couple of weeks. Either associated directly with OneDrive or occasionally with Word and an ai.exe process (assuming co-pilot here). Good to know we're not alone and that it will be fixed in the next content pack. Any ideas on dates for that please?

[Arman_Zaheri]

Hello,

Thanks for the clarification. Just to confirm, after which content release should we expect this problem is fixed? We're still receiving this alert, and I need to compare the client content version with the fixed one.

Br,