techcommunity.microsoft.com
Open in
urlscan Pro
2a02:26f0:3500:88d::207e
Public Scan
URL:
https://techcommunity.microsoft.com/t5/discussions/msedge-proxy-detected-using-sihost-exe-tag-as-behavioral-threat/m-p/3645143
Submission: On November 23 via api from DE — Scanned from DE
Submission: On November 23 via api from DE — Scanned from DE
Form analysis
2 forms found in the DOMName: form_f11b8ccf4eaeaf — POST https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.searchformv32.form.form
<form enctype="multipart/form-data" class="lia-form lia-form-inline SearchForm" action="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.searchformv32.form.form" method="post" id="form_f11b8ccf4eaeaf" name="form_f11b8ccf4eaeaf">
<div class="t-invisible"><input value="board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805" name="t:ac" type="hidden"><input value="search/contributions/page" name="t:cp" type="hidden"><input
value="A69XxpqBbhKDSTRQCZpyeSFKBP0hOKIqvS1r87SRjPEiyz-epaASGJG_X5s8_WKIBMRdWxX8fS_r_uLI9wZZCzT7QUP1-loPL6RB0jvtGhxDIDaPbL2RjbDftXE5c1Hx1jujvCPQ2gMdaMamow5R6tDDlfMZq3cU03hwFtHShexGgMHS4Z1hrVGxZF39nWGgVky53Cp1189OVgQIow9tFPGfhsfPsAzXXmHebxenihLyVkoJwzMEj91zPmpMRjWRGrMJv_FEPaV56MusHKC8P-ydB_ounMUA4kVArzfO1RWiY1_UfqwPyzClGqOuc775l6d5eqWA8hGb4PAHXWYvbfd1nxRKjZxPECv4VTzRt1YqO8T9ldx_Gx7QdOUzNV5QA3VSQJUJn4I9qlH6Zxp2PGl22t8tUhyX9wgXCVVWHLSRpi_nqet6aJ5hGn0qvaQw-riNHTaeG2DD9LA4chgxZmIVnZvhHYiYUuAoSQN3IxsEpBD6yrBXwM3-h4znvddQRFOvWKxmdeRTYLCCPBTs_O1leENc-98_SQok_aEZep3ekHUhU-3PnGtn7_Mx2hoBr-QldSFeXWWzSkaS5lyCaa0Cf6TtMiDqS4QAdePXmibADbtSkv9yQstnFMAVvvFeLFAAiPHNU9AWvRPhRC2-obpFbKKvM_GuMXg-Vx3FN4YXjUvQ-6bssP9D06Ft5f7AVAbh-BKx6E8jCEOZ-E1BOOe6lc98F3Zk-Mee1YFgt-zrGu8raCg-YoUXgTF5jy-dSa9WNzNaOp8VzW0CvILuYmJRHZAm3H_kCILfn2lRaVHOxGD4kko0KtYTfGXXLGb7PJ0VoCy4wMspGO367kb1m-N4RE15uLB4A2aLX67flLp4JqUv8QrWVxKfjUN2dMKwdCiM1Rcqd-zyeOYAEt9ZGTFbK_TgKoXvrJsPcxjnN-CiP71ZW8ZgQriRUjujIx2m2agB_7oUH7MRTDrBO6FmFapYZ4OL0hGj8ij1IxbGU-J753kMjJY6taTnlCC09V8oLB5zY0HOnNG626aTHBSRFNjuIerikToeg4VqXpTlH6qPrVZxZ0ssNviWPWXtSpN53f45EGPhOW5QaBf9lYvfgFbOtJvaquLky_a3IT2bp3A99HZbC4bEyfT2ihov9pEfc1i7_6o4GpPBdY5xJpYiTFrhGyIHzTP6qYwQJK4M8tx0hW7-rIq_pZRVz1bvAF-OyctP_R_8XjmcAN6ScfyPKMe8gIVNcT6ZuoX_vzqnuphvu9l9hejUuV5vYdM9RQdTJ69RGlhCw3Wm_qtduVCueg.."
name="lia-form-context" type="hidden"><input value="ForumTopicPage:board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805:searchformv32.form:" name="liaFormContentKey" type="hidden"><input
value="yDZKQFNI0U/sd9X4pbUemqvQQZw=:H4sIAAAAAAAAALWSzUrDQBSFr4Wuigiib6DbiajdqAhFUISqweBaZibTNJpk4sxNEzc+ik8gvkQX7nwHH8CtKxfmzxJbwaTUVZhzw/nOmblP79COD+FAC6r40OAyQOWyCF0ZaMOkjtgrJgOp/NHONtER810sP9nfIkGtoCuVQ2hI+VAQpKHQqO67hEslPJcRRrUgPZaKlOOxKzx7wxIYhZtX487b+stnC5b60MnZ0junvkBY7d/QETU8GjiGlUYKnP0kRFguwEcFeAHBe02Dm0pyobWV+Wid0sbP9u7g4/G1BZCE8QWc1U3kpzapWoqZ+S+SvoMHgPQ+ypGVj/IoC2dlqHZ8CWZdV7xljUqszZa43voPYNHkFE7qGkdaqKrl1Pm7wEqmV59gcYjGkQOJP25h6jyJnOlzRv4DUURusIWhknbEsWo5K002vhzNufG1WHmDLwdzh8gDBQAA"
name="t:formdata" type="hidden"></div>
<div class="lia-inline-ajax-feedback">
<div class="AjaxFeedback" id="feedback_f11b8ccf4eaeaf"></div>
</div>
<input value="BEY6fHBn4qw1F6QHn5g-cRzjX2fK8YyTSrO3hZUDjC8." name="lia-action-token" type="hidden">
<input value="form_f11b8ccf4eaeaf" id="form_UIDform_f11b8ccf4eaeaf" name="form_UID" type="hidden">
<input value="" id="form_instance_keyform_f11b8ccf4eaeaf" name="form_instance_key" type="hidden">
<span class="lia-search-input-wrapper">
<span class="lia-search-input-field">
<span class="lia-button-wrapper lia-button-wrapper-secondary lia-button-wrapper-searchForm-action"><input value="searchForm" name="submitContextX" type="hidden"><input class="lia-button lia-button-secondary lia-button-searchForm-action"
value="Search" id="submitContext_f11b8ccf4eaeaf" name="submitContext" type="submit" tabindex="-1"></span>
<input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-message" value="" id="messageSearchField_f11b8ccf4eaeaf_0" name="messageSearchField"
type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="EyUne9BLVRfxfTKYXt7f95yZiMq0dw3aYyzkPRcVNvA." rel="nofollow" id="disableAutoComplete_f11b8ccf73bcaa" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-tkb-article lia-js-hidden" value="" id="messageSearchField_f11b8ccf4eaeaf_1"
name="messageSearchField_0" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="5gZX3FU35yB9dY1Q4TAnlyibJDrgVPcrFkMc4ogmEqo." rel="nofollow" id="disableAutoComplete_f11b8ccffb17ba" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input placeholder="Search all content" ng-non-bindable="" title="Enter a user name or rank" class="lia-form-type-text UserSearchField lia-search-input-user search-input lia-js-hidden lia-autocomplete-input"
aria-label="Enter a user name or rank" value="" id="userSearchField_f11b8ccf4eaeaf" name="userSearchField" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a user name or rank</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="7hSEA59KE-TRm1MT_gJfUWljpF1W65DOs28T0UEJgz8." rel="nofollow" id="disableAutoComplete_f11b8cd02dd204" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input title="Enter a search word" class="lia-form-type-text NoteSearchField lia-search-input-note search-input lia-js-hidden lia-autocomplete-input" aria-label="Enter a search word" value="" id="noteSearchField_f11b8ccf4eaeaf_0"
name="noteSearchField" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="jy9TQoRZ4jc8P1tAJ_yyawDNUApRpJYMQUkceVmXBuw." rel="nofollow" id="disableAutoComplete_f11b8cd05fbf35" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input title="Enter a search word" class="lia-form-type-text ProductSearchField lia-search-input-product search-input lia-js-hidden lia-autocomplete-input" aria-label="Enter a search word" value="" id="productSearchField_f11b8ccf4eaeaf"
name="productSearchField" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="Se6A299wRC6MddY3PSP340HDOdORfeujqko_BBnvmGg." rel="nofollow" id="disableAutoComplete_f11b8cd098db9e" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input class="lia-as-search-action-id" name="as-search-action-id" type="hidden">
</span>
</span>
<span class="lia-cancel-search" tabindex="0">cancel</span>
</form>
Name: form — POST https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.searchformv32.form.form
<form enctype="multipart/form-data" class="lia-form lia-form-inline SearchForm" action="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.searchformv32.form.form" method="post" id="form" name="form">
<div class="t-invisible"><input value="board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805" name="t:ac" type="hidden"><input value="search/contributions/page" name="t:cp" type="hidden"><input
value="hxd0-XmlK6ra1nIPtmN2naBvFhvd28xwECqGwBnY_j83l2DhtwSuHy_S-J35hQTDMqzUuFyn7HSE18RlkXgIcX1ArNGJVJPb1qzgTCc-k50hRCHuccqZkuZQzHV7XjuYqdDf9_4PjOlgjffcWvAV6h4mDG9tuZqMc8fUK1Xht-jcFKLE7TGCvHOoUwzL3TqfbectiKNEZ6btbyBb9oEn6lwnG0i1i6JJWIG8WZgXUg7Pu37mQgrzO-WaKUFeyFenaQRsNflvUoLDVHIePYl-0laaCVQUFtkV12R8M8UqAj2t6JLD-_ibQwdfje40komEQZyotDKySuxmuQufV_qr4_qGhwx4b9bUAaEP14gQxrYxCNpQgrXRubpGkEPnnhyelRn87AVoYv0F_Mv4-S5xAAIsJe-JwCtpzSC_JObpyLfnGKURUl1T_OrrowuqgvHdp-JaaIrpt-dTMS-Ss9Z-LG_mCSQNghgGzsTz-9CUkUmm_s8KYERfBcshPN02hQDSFEZCOG3J28QysYQtFNxFBr7jsTv2T7WCvDooesWC8-d--ExK-D2ec8gefpMqK2hsuQotb3nv0zJ0tx_BSSU56-8OrjERYkzIbK6c0R-lcC7hCY_jE1aV20phqX-bDN1iEPSuWkIZQJJzgPhHGyM_1Gj6NTMwi3T7cG5kkNICv9BpNeIK9bnmlTz9RHMWBzJAXLqd6rpj5Rr7iU8bKBJiCRPbpejCpezOL6qCt54J9pMkR-URipdTRwRAq1jco1TSke5Tj3GeNieQnz4EPTsHN83iNiZgyiFKGOxhiZ0b1U1wlrc8SGXxy5_06fY34fmOeFBiY1VgemVYmxwOMT3vnBaag6pEsdL1K49Z0QCg6-7YxneuNYZm89PxR2SSH3nxYo6IJ4_VOz1QIfUKtYXf2ppGmk5nXLGiBpMAOg4pafYNJEaAa9uIpns8ciMh8CveaKh1v8T0YwJ6Ph1FpJW2nf7d4RPZE_XdJHG8oamGCH0x8qPS1MaV--4dPFUUB4jdFT0xy0iJAkSC07oTWW9xNkwOw9k7nm8BsrZWUDyjMLu3QtrPUWd3mZrmU2pJiScOO-VEKUNPZ6rYxNO7hxmKiuRPadViCHVf0wxsbQ9sW4xwDWI9mdnDz7c1JxwKS0t-O_Y5RLy0r_S6bSywZPvbdHILVNRu_cKriDK4XLQBAv8."
name="lia-form-context" type="hidden"><input value="ForumTopicPage:board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805:searchformv32.form:" name="liaFormContentKey" type="hidden"><input
value="yDZKQFNI0U/sd9X4pbUemqvQQZw=:H4sIAAAAAAAAALWSzUrDQBSFr4Wuigiib6DbiajdqAhFUISqweBaZibTNJpk4sxNEzc+ik8gvkQX7nwHH8CtKxfmzxJbwaTUVZhzw/nOmblP79COD+FAC6r40OAyQOWyCF0ZaMOkjtgrJgOp/NHONtER810sP9nfIkGtoCuVQ2hI+VAQpKHQqO67hEslPJcRRrUgPZaKlOOxKzx7wxIYhZtX487b+stnC5b60MnZ0junvkBY7d/QETU8GjiGlUYKnP0kRFguwEcFeAHBe02Dm0pyobWV+Wid0sbP9u7g4/G1BZCE8QWc1U3kpzapWoqZ+S+SvoMHgPQ+ypGVj/IoC2dlqHZ8CWZdV7xljUqszZa43voPYNHkFE7qGkdaqKrl1Pm7wEqmV59gcYjGkQOJP25h6jyJnOlzRv4DUURusIWhknbEsWo5K002vhzNufG1WHmDLwdzh8gDBQAA"
name="t:formdata" type="hidden"></div>
<div class="lia-inline-ajax-feedback">
<div class="AjaxFeedback" id="feedback"></div>
</div>
<input value="37aO2mAbNm8TllkXZ7st8I5FYJCq7xQO5eNCsV9odHo." name="lia-action-token" type="hidden">
<input value="form" id="form_UIDform" name="form_UID" type="hidden">
<input value="" id="form_instance_keyform" name="form_instance_key" type="hidden">
<span class="lia-search-input-wrapper">
<span class="lia-search-input-field">
<span class="lia-button-wrapper lia-button-wrapper-secondary lia-button-wrapper-searchForm-action"><input value="searchForm" name="submitContextX" type="hidden"><input class="lia-button lia-button-secondary lia-button-searchForm-action"
value="Search" id="submitContext" name="submitContext" type="submit" tabindex="-1"></span>
<input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-message" value="" id="messageSearchField_0" name="messageSearchField" type="text"
aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="RYSi0OsnoXbbx-oHfbaRGOhuVVctSAqIq54iWzwohdY." rel="nofollow" id="disableAutoComplete_f11b8cd11ccad3" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-tkb-article lia-js-hidden" value="" id="messageSearchField_1"
name="messageSearchField_0" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="U7sVWfcmvqviFVCMooLft3gF79xLzgiHg9Y9latq2MY." rel="nofollow" id="disableAutoComplete_f11b8cd1494a71" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input placeholder="Search all content" ng-non-bindable="" title="Enter a user name or rank" class="lia-form-type-text UserSearchField lia-search-input-user search-input lia-js-hidden lia-autocomplete-input"
aria-label="Enter a user name or rank" value="" id="userSearchField" name="userSearchField" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a user name or rank</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="wqe6IMp74YmmkV5mtxtRTWRGoI522Up0XZykIptDKdw." rel="nofollow" id="disableAutoComplete_f11b8cd16fe4f1" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input title="Enter a search word" class="lia-form-type-text NoteSearchField lia-search-input-note search-input lia-js-hidden lia-autocomplete-input" aria-label="Enter a search word" value="" id="noteSearchField_0" name="noteSearchField"
type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="E5K37TSEaxmuvD8lY3Q2zkB6fCf8ua5isiUXjWtYIGo." rel="nofollow" id="disableAutoComplete_f11b8cd19a9411" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input title="Enter a search word" class="lia-form-type-text ProductSearchField lia-search-input-product search-input lia-js-hidden lia-autocomplete-input" aria-label="Enter a search word" value="" id="productSearchField"
name="productSearchField" type="text" aria-autocomplete="both" autocomplete="off">
<div class="lia-autocomplete-container" style="display: none; position: absolute;">
<div class="lia-autocomplete-header">Enter a search word</div>
<div class="lia-autocomplete-content">
<ul></ul>
</div>
<div class="lia-autocomplete-footer">
<a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="xVC3Y-9mneRAmEpvoJrE54AWowNXtAG9bb5sXU5vUgc." rel="nofollow" id="disableAutoComplete_f11b8cd1ce0722" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&t:cp=action/contributions/searchactions">Turn off suggestions</a>
</div>
</div>
<input class="lia-as-search-action-id" name="as-search-action-id" type="hidden">
</span>
</span>
<span class="lia-cancel-search">cancel</span>
</form>
Text Content
We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies Accept Reject Manage cookies Skip to Main Content Microsoft Tech Community Home Community Hubs Community Hubs * Community Hubs Home * Products * Special Topics * Video Hub Close PRODUCTS (51) SPECIAL TOPICS (28) VIDEO HUB (447) MOST ACTIVE HUBS Microsoft Excel Microsoft Teams Windows Security, Compliance and Identity Microsoft 365 Outlook SharePoint Azure Exchange Windows Server Intune and Configuration Manager Microsoft Viva .NET Sharing best practices for building any app with .NET. Microsoft FastTrack Best practices and the latest news on Microsoft FastTrack Microsoft Sales Copilot A role-based copilot designed for sellers MOST ACTIVE HUBS Education Sector ITOps Talk Microsoft Partner Community AI and Machine Learning Core Infrastructure and Security Microsoft Mechanics Healthcare and Life Sciences Internet of Things (IoT) Public Sector Regional Blogs Mixed Reality Azure Partner Community Expand your Azure partner-to-partner network Microsoft Tech Talks Bringing IT Pros together through In-Person & Virtual events MVP Award Program Find out more about the Microsoft MVP Award Program. VIDEO HUB Azure Exchange Microsoft 365 Microsoft 365 Business Microsoft 365 Enterprise Microsoft Edge Microsoft Outlook Microsoft Teams Security SharePoint Windows Browse All Community Hubs Blogs Blogs Events Events * Events Home * Microsoft Ignite * Microsoft Build * Community Events Microsoft Learn Microsoft Learn * Home * Community * Blog * Azure * Dynamics 365 * Microsoft 365 * Security, Compliance & Identity * Power Platform * Github * Teams * .NET Lounge Lounge * 1.2M Members * 7,970 Online * 309K Discussions Search Enter a search word Turn off suggestions Enter a search word Turn off suggestions Enter a user name or rank Turn off suggestions Enter a search word Turn off suggestions Enter a search word Turn off suggestions cancel Turn on suggestions Showing results for Show only | Search instead for Did you mean: Sign In Sign In Enter a search word Turn off suggestions Enter a search word Turn off suggestions Enter a user name or rank Turn off suggestions Enter a search word Turn off suggestions Enter a search word Turn off suggestions cancel Turn on suggestions Showing results for Show only | Search instead for Did you mean: * Home * Microsoft Edge Insider * Discussions * Msedge_proxy detected using sihost.exe tag as Behavioral threat "process spoofing" bu our cortex XDR Skip to Topic Message MSEDGE_PROXY DETECTED USING SIHOST.EXE TAG AS BEHAVIORAL THREAT "PROCESS SPOOFING" BU OUR CORTEX XDR Discussion Options * Subscribe to RSS Feed * * Mark Discussion as New * Mark Discussion as Read * * Pin this Discussion for Current User * Bookmark * Subscribe * * Printer Friendly Page lecksbush25 Copper Contributor Oct 05 2022 09:16 AM * Mark as New * Bookmark * Subscribe * Mute * * Subscribe to RSS Feed * * Permalink * Print * * Report Inappropriate Content Oct 05 2022 09:16 AM MSEDGE_PROXY DETECTED USING SIHOST.EXE TAG AS BEHAVIORAL THREAT "PROCESS SPOOFING" BU OUR CORTEX XDR Hi, We recently identified (Monday, October 3, 2022) that there was being flagged as a high behavioral threat by our endpoint protection (Cortex XDR) on multiple computers across our organization; upon checking the incident case, All of them are being executed by msedge_proxy.exe which chains its command to sihost.exe. I want to know if this is a false positive and if it's normal or a bug. Please see the details I can provide below: Cortex Info: Alert Name: Behavioral Threat Source: XDR Agent Category: Malware Module: Behavioral Threat Protection Severity: High Description: Behavioral threat detected (rule: parent_process_spoofing) Action: Detected (Reported) Process Information: Command Line : "c:\program files (x86)\microsoft\edge\application\msedge_proxy.exe" --notification-launch-id=0|1|default|0|https://mail.google.com/|n#https://mail.google.com#fnjqw9hny8w/114987728825504974251 Original Command Line : "C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe" --notification-launch-id=0|1|Default|0|https://mail.google.com/|n#https://mail.google.com#FnJqW9hNy8w/114987728825504974251 File Name : msedge_proxy Description : microsoft edge Company : microsoft corporation Copyright : copyright microsoft corporation. all rights reserved. Original Name : msedge_proxy.exe Signature Status : Signed Singature Details : Valid Signer : Microsoft Corporation Loaded From TxF : 0 Parent PID : 15176 Image Path : c:\program files (x86)\microsoft\edge\application\msedge_proxy.exe Image SHA256 : 89e4d5d11099e0667541e78977444ebe5d41e536f8c23403957d7da3be634f1f Image MD5 : 131707b12b97b5a0e810dd7a0d4038dc Effective SID : S-1-5-21-584199959-4099986459-2772195892-1168 From Remote Session : 0 Parent Thread ID : 4294967295 StartupInfo Parent PID : 9276 OS Parent PID : 9940 This is one of the computers reporting we detecting all triggering the endpoint with the msedge_proxy. 5,003 Views 1 Like 2 Replies Reply undefined * All Discussions * Previous Discussion * Next Discussion 2 Replies zer0trust replied to lecksbush25 Oct 10 2022 06:44 AM * Mark as New * Bookmark * Subscribe * Mute * * Subscribe to RSS Feed * * Permalink * Print * * Report Inappropriate Content Oct 10 2022 06:44 AM RE: MSEDGE_PROXY DETECTED USING SIHOST.EXE TAG AS BEHAVIORAL THREAT "PROCESS SPOOFING" BU @lecksbush25 We are also seeing this issue in our Cortex tenant on a few computers. Any updates or additional information on this one? 0 Likes Reply CyberZealand replied to lecksbush25 Oct 10 2022 02:09 PM * Mark as New * Bookmark * Subscribe * Mute * * Subscribe to RSS Feed * * Permalink * Print * * Report Inappropriate Content Oct 10 2022 02:09 PM RE: MSEDGE_PROXY DETECTED USING SIHOST.EXE TAG AS BEHAVIORAL THREAT "PROCESS SPOOFING" BU We've also encountered a similar form of issue. I'd recommend looking closely at content version of the machine at the time of alert. Palo Alto Support: "I would like to inform you that, these are False positives and also there is a fix release on the content update 710-19689. From the logs I can see that you are in content update 710-19496 that is why you are getting these alerts." 1 Like Reply undefined SHARE * Share to LinkedIn * Share to Facebook * Share to Twitter * Share to Reddit * Share to Email Browse Skip to Primary Navigation What's new * Surface Pro 9 * Surface Laptop 5 * Surface Studio 2+ * Surface Laptop Go 2 * Surface Laptop Studio * Surface Duo 2 * Microsoft 365 * Windows 11 apps Microsoft Store * Account profile * Download Center * Microsoft Store support * Returns * Order tracking * Virtual workshops and training * Microsoft Store Promise * Flexible Payments Education * Microsoft in education * Devices for education * Microsoft Teams for Education * Microsoft 365 Education * Education consultation appointment * Educator training and development * Deals for students and parents * Azure for students Business * Microsoft Cloud * Microsoft Security * Dynamics 365 * Microsoft 365 * Microsoft Power Platform * Microsoft Teams * Microsoft Industry * Small Business Developer & IT * Azure * Developer Center * Documentation * Microsoft Learn * Microsoft Tech Community * Azure Marketplace * AppSource * Visual Studio Company * Careers * About Microsoft * Company news * Privacy at Microsoft * Investors * Diversity and inclusion * Accessibility * Sustainability * Sitemap * Contact Microsoft * Privacy * Manage cookies * Terms of use * Trademarks * Safety & eco * About our ads * © Microsoft 2023 Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type. Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.