Due to a false positive issue, Microsoft Defender for Endpoint has flagged Google Chrome updates delivered through Google Update as suspicious activity.
According to the Windows System Administrator Report [1, 2, 3, 4]Security Solutions (formerly known as Microsoft Defender ATP) began marking Chrome updates as suspicious last night.
Users who experienced this issue reported seeing “Multi-phase events involving execution and defense evasion” alerts on affected Windows endpoints monitored with Defender for Endpoint.
In a Microsoft 365 Defender Service Bulletin published after reports of these alert alerts started appearing online, Microsoft revealed that they were triggered by false positives and not due to malicious activity.
“Administrators may receive false alarms about Google Updates on Microsoft Defender for Endpoint monitoring devices,” Microsoft said.
About an hour and a half later, the bulletin was updated, and Redmond said the false positives had been resolved and service had been restored.
A Microsoft spokesperson told BleepingComputer: “We determined these were false positive results and we have updated the logic of this alert to address issues that some customers may be experiencing.”
Defenders of endpoint false positives (Kevin Gray)
Over the past two years, Windows administrators have had to deal with multiple other Defender for Endpoint false positives.
For example, they were hit by a wave of Defender for Endpoint alerts in which Office updates were flagged as malicious, pointing to ransomware behavior detected on Windows endpoints.
In November, Defender ATP blocked Office documents and some Office executables from opening or launching due to another false positive flagging the Emotet malware payload file.
A month later, it incorrectly displayed the same Microsoft 365 Defender Scanner for Log4j Processes.
Other similar Defender for Endpoint issues include a Cobalt Strike-infected network device alert and a Chrome update that acts as a PHP backdoor, both caused by false positive detections.
Update: Added Microsoft statement.
