techcommunity.microsoft.com Open in urlscan Pro
2a02:26f0:3500:88d::207e  Public Scan

URL: https://techcommunity.microsoft.com/t5/discussions/msedge-proxy-detected-using-sihost-exe-tag-as-behavioral-threat/m-p/3645143
Submission: On November 23 via api from DE — Scanned from DE

Form analysis 2 forms found in the DOM

Name: form_f11b8ccf4eaeafPOST https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.searchformv32.form.form

<form enctype="multipart/form-data" class="lia-form lia-form-inline SearchForm" action="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.searchformv32.form.form" method="post" id="form_f11b8ccf4eaeaf" name="form_f11b8ccf4eaeaf">
  <div class="t-invisible"><input value="board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805" name="t:ac" type="hidden"><input value="search/contributions/page" name="t:cp" type="hidden"><input
      value="A69XxpqBbhKDSTRQCZpyeSFKBP0hOKIqvS1r87SRjPEiyz-epaASGJG_X5s8_WKIBMRdWxX8fS_r_uLI9wZZCzT7QUP1-loPL6RB0jvtGhxDIDaPbL2RjbDftXE5c1Hx1jujvCPQ2gMdaMamow5R6tDDlfMZq3cU03hwFtHShexGgMHS4Z1hrVGxZF39nWGgVky53Cp1189OVgQIow9tFPGfhsfPsAzXXmHebxenihLyVkoJwzMEj91zPmpMRjWRGrMJv_FEPaV56MusHKC8P-ydB_ounMUA4kVArzfO1RWiY1_UfqwPyzClGqOuc775l6d5eqWA8hGb4PAHXWYvbfd1nxRKjZxPECv4VTzRt1YqO8T9ldx_Gx7QdOUzNV5QA3VSQJUJn4I9qlH6Zxp2PGl22t8tUhyX9wgXCVVWHLSRpi_nqet6aJ5hGn0qvaQw-riNHTaeG2DD9LA4chgxZmIVnZvhHYiYUuAoSQN3IxsEpBD6yrBXwM3-h4znvddQRFOvWKxmdeRTYLCCPBTs_O1leENc-98_SQok_aEZep3ekHUhU-3PnGtn7_Mx2hoBr-QldSFeXWWzSkaS5lyCaa0Cf6TtMiDqS4QAdePXmibADbtSkv9yQstnFMAVvvFeLFAAiPHNU9AWvRPhRC2-obpFbKKvM_GuMXg-Vx3FN4YXjUvQ-6bssP9D06Ft5f7AVAbh-BKx6E8jCEOZ-E1BOOe6lc98F3Zk-Mee1YFgt-zrGu8raCg-YoUXgTF5jy-dSa9WNzNaOp8VzW0CvILuYmJRHZAm3H_kCILfn2lRaVHOxGD4kko0KtYTfGXXLGb7PJ0VoCy4wMspGO367kb1m-N4RE15uLB4A2aLX67flLp4JqUv8QrWVxKfjUN2dMKwdCiM1Rcqd-zyeOYAEt9ZGTFbK_TgKoXvrJsPcxjnN-CiP71ZW8ZgQriRUjujIx2m2agB_7oUH7MRTDrBO6FmFapYZ4OL0hGj8ij1IxbGU-J753kMjJY6taTnlCC09V8oLB5zY0HOnNG626aTHBSRFNjuIerikToeg4VqXpTlH6qPrVZxZ0ssNviWPWXtSpN53f45EGPhOW5QaBf9lYvfgFbOtJvaquLky_a3IT2bp3A99HZbC4bEyfT2ihov9pEfc1i7_6o4GpPBdY5xJpYiTFrhGyIHzTP6qYwQJK4M8tx0hW7-rIq_pZRVz1bvAF-OyctP_R_8XjmcAN6ScfyPKMe8gIVNcT6ZuoX_vzqnuphvu9l9hejUuV5vYdM9RQdTJ69RGlhCw3Wm_qtduVCueg.."
      name="lia-form-context" type="hidden"><input value="ForumTopicPage:board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805:searchformv32.form:" name="liaFormContentKey" type="hidden"><input
      value="yDZKQFNI0U/sd9X4pbUemqvQQZw=:H4sIAAAAAAAAALWSzUrDQBSFr4Wuigiib6DbiajdqAhFUISqweBaZibTNJpk4sxNEzc+ik8gvkQX7nwHH8CtKxfmzxJbwaTUVZhzw/nOmblP79COD+FAC6r40OAyQOWyCF0ZaMOkjtgrJgOp/NHONtER810sP9nfIkGtoCuVQ2hI+VAQpKHQqO67hEslPJcRRrUgPZaKlOOxKzx7wxIYhZtX487b+stnC5b60MnZ0junvkBY7d/QETU8GjiGlUYKnP0kRFguwEcFeAHBe02Dm0pyobWV+Wid0sbP9u7g4/G1BZCE8QWc1U3kpzapWoqZ+S+SvoMHgPQ+ypGVj/IoC2dlqHZ8CWZdV7xljUqszZa43voPYNHkFE7qGkdaqKrl1Pm7wEqmV59gcYjGkQOJP25h6jyJnOlzRv4DUURusIWhknbEsWo5K002vhzNufG1WHmDLwdzh8gDBQAA"
      name="t:formdata" type="hidden"></div>
  <div class="lia-inline-ajax-feedback">
    <div class="AjaxFeedback" id="feedback_f11b8ccf4eaeaf"></div>
  </div>
  <input value="BEY6fHBn4qw1F6QHn5g-cRzjX2fK8YyTSrO3hZUDjC8." name="lia-action-token" type="hidden">
  <input value="form_f11b8ccf4eaeaf" id="form_UIDform_f11b8ccf4eaeaf" name="form_UID" type="hidden">
  <input value="" id="form_instance_keyform_f11b8ccf4eaeaf" name="form_instance_key" type="hidden">
  <span class="lia-search-input-wrapper">
    <span class="lia-search-input-field">
      <span class="lia-button-wrapper lia-button-wrapper-secondary lia-button-wrapper-searchForm-action"><input value="searchForm" name="submitContextX" type="hidden"><input class="lia-button lia-button-secondary lia-button-searchForm-action"
          value="Search" id="submitContext_f11b8ccf4eaeaf" name="submitContext" type="submit" tabindex="-1"></span>
      <input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-message" value="" id="messageSearchField_f11b8ccf4eaeaf_0" name="messageSearchField"
        type="text" aria-autocomplete="both" autocomplete="off">
      <div class="lia-autocomplete-container" style="display: none; position: absolute;">
        <div class="lia-autocomplete-header">Enter a search word</div>
        <div class="lia-autocomplete-content">
          <ul></ul>
        </div>
        <div class="lia-autocomplete-footer">
          <a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="EyUne9BLVRfxfTKYXt7f95yZiMq0dw3aYyzkPRcVNvA." rel="nofollow" id="disableAutoComplete_f11b8ccf73bcaa" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&amp;t:cp=action/contributions/searchactions">Turn off suggestions</a>
        </div>
      </div>
      <input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-tkb-article lia-js-hidden" value="" id="messageSearchField_f11b8ccf4eaeaf_1"
        name="messageSearchField_0" type="text" aria-autocomplete="both" autocomplete="off">
      <div class="lia-autocomplete-container" style="display: none; position: absolute;">
        <div class="lia-autocomplete-header">Enter a search word</div>
        <div class="lia-autocomplete-content">
          <ul></ul>
        </div>
        <div class="lia-autocomplete-footer">
          <a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="5gZX3FU35yB9dY1Q4TAnlyibJDrgVPcrFkMc4ogmEqo." rel="nofollow" id="disableAutoComplete_f11b8ccffb17ba" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&amp;t:cp=action/contributions/searchactions">Turn off suggestions</a>
        </div>
      </div>
      <input placeholder="Search all content" ng-non-bindable="" title="Enter a user name or rank" class="lia-form-type-text UserSearchField lia-search-input-user search-input lia-js-hidden lia-autocomplete-input"
        aria-label="Enter a user name or rank" value="" id="userSearchField_f11b8ccf4eaeaf" name="userSearchField" type="text" aria-autocomplete="both" autocomplete="off">
      <div class="lia-autocomplete-container" style="display: none; position: absolute;">
        <div class="lia-autocomplete-header">Enter a user name or rank</div>
        <div class="lia-autocomplete-content">
          <ul></ul>
        </div>
        <div class="lia-autocomplete-footer">
          <a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="7hSEA59KE-TRm1MT_gJfUWljpF1W65DOs28T0UEJgz8." rel="nofollow" id="disableAutoComplete_f11b8cd02dd204" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&amp;t:cp=action/contributions/searchactions">Turn off suggestions</a>
        </div>
      </div>
      <input title="Enter a search word" class="lia-form-type-text NoteSearchField lia-search-input-note search-input lia-js-hidden lia-autocomplete-input" aria-label="Enter a search word" value="" id="noteSearchField_f11b8ccf4eaeaf_0"
        name="noteSearchField" type="text" aria-autocomplete="both" autocomplete="off">
      <div class="lia-autocomplete-container" style="display: none; position: absolute;">
        <div class="lia-autocomplete-header">Enter a search word</div>
        <div class="lia-autocomplete-content">
          <ul></ul>
        </div>
        <div class="lia-autocomplete-footer">
          <a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="jy9TQoRZ4jc8P1tAJ_yyawDNUApRpJYMQUkceVmXBuw." rel="nofollow" id="disableAutoComplete_f11b8cd05fbf35" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&amp;t:cp=action/contributions/searchactions">Turn off suggestions</a>
        </div>
      </div>
      <input title="Enter a search word" class="lia-form-type-text ProductSearchField lia-search-input-product search-input lia-js-hidden lia-autocomplete-input" aria-label="Enter a search word" value="" id="productSearchField_f11b8ccf4eaeaf"
        name="productSearchField" type="text" aria-autocomplete="both" autocomplete="off">
      <div class="lia-autocomplete-container" style="display: none; position: absolute;">
        <div class="lia-autocomplete-header">Enter a search word</div>
        <div class="lia-autocomplete-content">
          <ul></ul>
        </div>
        <div class="lia-autocomplete-footer">
          <a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="Se6A299wRC6MddY3PSP340HDOdORfeujqko_BBnvmGg." rel="nofollow" id="disableAutoComplete_f11b8cd098db9e" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&amp;t:cp=action/contributions/searchactions">Turn off suggestions</a>
        </div>
      </div>
      <input class="lia-as-search-action-id" name="as-search-action-id" type="hidden">
    </span>
  </span>
  <span class="lia-cancel-search" tabindex="0">cancel</span>
</form>

Name: formPOST https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.searchformv32.form.form

<form enctype="multipart/form-data" class="lia-form lia-form-inline SearchForm" action="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.searchformv32.form.form" method="post" id="form" name="form">
  <div class="t-invisible"><input value="board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805" name="t:ac" type="hidden"><input value="search/contributions/page" name="t:cp" type="hidden"><input
      value="hxd0-XmlK6ra1nIPtmN2naBvFhvd28xwECqGwBnY_j83l2DhtwSuHy_S-J35hQTDMqzUuFyn7HSE18RlkXgIcX1ArNGJVJPb1qzgTCc-k50hRCHuccqZkuZQzHV7XjuYqdDf9_4PjOlgjffcWvAV6h4mDG9tuZqMc8fUK1Xht-jcFKLE7TGCvHOoUwzL3TqfbectiKNEZ6btbyBb9oEn6lwnG0i1i6JJWIG8WZgXUg7Pu37mQgrzO-WaKUFeyFenaQRsNflvUoLDVHIePYl-0laaCVQUFtkV12R8M8UqAj2t6JLD-_ibQwdfje40komEQZyotDKySuxmuQufV_qr4_qGhwx4b9bUAaEP14gQxrYxCNpQgrXRubpGkEPnnhyelRn87AVoYv0F_Mv4-S5xAAIsJe-JwCtpzSC_JObpyLfnGKURUl1T_OrrowuqgvHdp-JaaIrpt-dTMS-Ss9Z-LG_mCSQNghgGzsTz-9CUkUmm_s8KYERfBcshPN02hQDSFEZCOG3J28QysYQtFNxFBr7jsTv2T7WCvDooesWC8-d--ExK-D2ec8gefpMqK2hsuQotb3nv0zJ0tx_BSSU56-8OrjERYkzIbK6c0R-lcC7hCY_jE1aV20phqX-bDN1iEPSuWkIZQJJzgPhHGyM_1Gj6NTMwi3T7cG5kkNICv9BpNeIK9bnmlTz9RHMWBzJAXLqd6rpj5Rr7iU8bKBJiCRPbpejCpezOL6qCt54J9pMkR-URipdTRwRAq1jco1TSke5Tj3GeNieQnz4EPTsHN83iNiZgyiFKGOxhiZ0b1U1wlrc8SGXxy5_06fY34fmOeFBiY1VgemVYmxwOMT3vnBaag6pEsdL1K49Z0QCg6-7YxneuNYZm89PxR2SSH3nxYo6IJ4_VOz1QIfUKtYXf2ppGmk5nXLGiBpMAOg4pafYNJEaAa9uIpns8ciMh8CveaKh1v8T0YwJ6Ph1FpJW2nf7d4RPZE_XdJHG8oamGCH0x8qPS1MaV--4dPFUUB4jdFT0xy0iJAkSC07oTWW9xNkwOw9k7nm8BsrZWUDyjMLu3QtrPUWd3mZrmU2pJiScOO-VEKUNPZ6rYxNO7hxmKiuRPadViCHVf0wxsbQ9sW4xwDWI9mdnDz7c1JxwKS0t-O_Y5RLy0r_S6bSywZPvbdHILVNRu_cKriDK4XLQBAv8."
      name="lia-form-context" type="hidden"><input value="ForumTopicPage:board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805:searchformv32.form:" name="liaFormContentKey" type="hidden"><input
      value="yDZKQFNI0U/sd9X4pbUemqvQQZw=:H4sIAAAAAAAAALWSzUrDQBSFr4Wuigiib6DbiajdqAhFUISqweBaZibTNJpk4sxNEzc+ik8gvkQX7nwHH8CtKxfmzxJbwaTUVZhzw/nOmblP79COD+FAC6r40OAyQOWyCF0ZaMOkjtgrJgOp/NHONtER810sP9nfIkGtoCuVQ2hI+VAQpKHQqO67hEslPJcRRrUgPZaKlOOxKzx7wxIYhZtX487b+stnC5b60MnZ0junvkBY7d/QETU8GjiGlUYKnP0kRFguwEcFeAHBe02Dm0pyobWV+Wid0sbP9u7g4/G1BZCE8QWc1U3kpzapWoqZ+S+SvoMHgPQ+ypGVj/IoC2dlqHZ8CWZdV7xljUqszZa43voPYNHkFE7qGkdaqKrl1Pm7wEqmV59gcYjGkQOJP25h6jyJnOlzRv4DUURusIWhknbEsWo5K002vhzNufG1WHmDLwdzh8gDBQAA"
      name="t:formdata" type="hidden"></div>
  <div class="lia-inline-ajax-feedback">
    <div class="AjaxFeedback" id="feedback"></div>
  </div>
  <input value="37aO2mAbNm8TllkXZ7st8I5FYJCq7xQO5eNCsV9odHo." name="lia-action-token" type="hidden">
  <input value="form" id="form_UIDform" name="form_UID" type="hidden">
  <input value="" id="form_instance_keyform" name="form_instance_key" type="hidden">
  <span class="lia-search-input-wrapper">
    <span class="lia-search-input-field">
      <span class="lia-button-wrapper lia-button-wrapper-secondary lia-button-wrapper-searchForm-action"><input value="searchForm" name="submitContextX" type="hidden"><input class="lia-button lia-button-secondary lia-button-searchForm-action"
          value="Search" id="submitContext" name="submitContext" type="submit" tabindex="-1"></span>
      <input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-message" value="" id="messageSearchField_0" name="messageSearchField" type="text"
        aria-autocomplete="both" autocomplete="off">
      <div class="lia-autocomplete-container" style="display: none; position: absolute;">
        <div class="lia-autocomplete-header">Enter a search word</div>
        <div class="lia-autocomplete-content">
          <ul></ul>
        </div>
        <div class="lia-autocomplete-footer">
          <a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="RYSi0OsnoXbbx-oHfbaRGOhuVVctSAqIq54iWzwohdY." rel="nofollow" id="disableAutoComplete_f11b8cd11ccad3" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&amp;t:cp=action/contributions/searchactions">Turn off suggestions</a>
        </div>
      </div>
      <input placeholder="Search the community" aria-label="Search" title="Search" class="lia-form-type-text lia-autocomplete-input search-input lia-search-input-tkb-article lia-js-hidden" value="" id="messageSearchField_1"
        name="messageSearchField_0" type="text" aria-autocomplete="both" autocomplete="off">
      <div class="lia-autocomplete-container" style="display: none; position: absolute;">
        <div class="lia-autocomplete-header">Enter a search word</div>
        <div class="lia-autocomplete-content">
          <ul></ul>
        </div>
        <div class="lia-autocomplete-footer">
          <a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="U7sVWfcmvqviFVCMooLft3gF79xLzgiHg9Y9latq2MY." rel="nofollow" id="disableAutoComplete_f11b8cd1494a71" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&amp;t:cp=action/contributions/searchactions">Turn off suggestions</a>
        </div>
      </div>
      <input placeholder="Search all content" ng-non-bindable="" title="Enter a user name or rank" class="lia-form-type-text UserSearchField lia-search-input-user search-input lia-js-hidden lia-autocomplete-input"
        aria-label="Enter a user name or rank" value="" id="userSearchField" name="userSearchField" type="text" aria-autocomplete="both" autocomplete="off">
      <div class="lia-autocomplete-container" style="display: none; position: absolute;">
        <div class="lia-autocomplete-header">Enter a user name or rank</div>
        <div class="lia-autocomplete-content">
          <ul></ul>
        </div>
        <div class="lia-autocomplete-footer">
          <a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="wqe6IMp74YmmkV5mtxtRTWRGoI522Up0XZykIptDKdw." rel="nofollow" id="disableAutoComplete_f11b8cd16fe4f1" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&amp;t:cp=action/contributions/searchactions">Turn off suggestions</a>
        </div>
      </div>
      <input title="Enter a search word" class="lia-form-type-text NoteSearchField lia-search-input-note search-input lia-js-hidden lia-autocomplete-input" aria-label="Enter a search word" value="" id="noteSearchField_0" name="noteSearchField"
        type="text" aria-autocomplete="both" autocomplete="off">
      <div class="lia-autocomplete-container" style="display: none; position: absolute;">
        <div class="lia-autocomplete-header">Enter a search word</div>
        <div class="lia-autocomplete-content">
          <ul></ul>
        </div>
        <div class="lia-autocomplete-footer">
          <a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="E5K37TSEaxmuvD8lY3Q2zkB6fCf8ua5isiUXjWtYIGo." rel="nofollow" id="disableAutoComplete_f11b8cd19a9411" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&amp;t:cp=action/contributions/searchactions">Turn off suggestions</a>
        </div>
      </div>
      <input title="Enter a search word" class="lia-form-type-text ProductSearchField lia-search-input-product search-input lia-js-hidden lia-autocomplete-input" aria-label="Enter a search word" value="" id="productSearchField"
        name="productSearchField" type="text" aria-autocomplete="both" autocomplete="off">
      <div class="lia-autocomplete-container" style="display: none; position: absolute;">
        <div class="lia-autocomplete-header">Enter a search word</div>
        <div class="lia-autocomplete-content">
          <ul></ul>
        </div>
        <div class="lia-autocomplete-footer">
          <a class="lia-link-navigation lia-autocomplete-toggle-off lia-link-ticket-post-action lia-component-search-action-disable-auto-complete" data-lia-action-token="xVC3Y-9mneRAmEpvoJrE54AWowNXtAG9bb5sXU5vUgc." rel="nofollow" id="disableAutoComplete_f11b8cd1ce0722" href="https://techcommunity.microsoft.com/t5/forums/v5/forumtopicpage.disableautocomplete:disableautocomplete?t:ac=board-id/EdgeInsiderDiscussions/message-id/55805/thread-id/55805&amp;t:cp=action/contributions/searchactions">Turn off suggestions</a>
        </div>
      </div>
      <input class="lia-as-search-action-id" name="as-search-action-id" type="hidden">
    </span>
  </span>
  <span class="lia-cancel-search">cancel</span>
</form>

Text Content

We use optional cookies to improve your experience on our websites, such as
through social media connections, and to display personalized advertising based
on your online activity. If you reject optional cookies, only cookies necessary
to provide you the services will be used. You may change your selection by
clicking “Manage Cookies” at the bottom of the page. Privacy Statement
Third-Party Cookies

Accept Reject Manage cookies


Skip to Main Content

Microsoft

Tech Community

Home

Community Hubs

Community Hubs
 * Community Hubs Home
 * Products
 * Special Topics
 * Video Hub

Close


PRODUCTS (51)


SPECIAL TOPICS (28)


VIDEO HUB (447)


MOST ACTIVE HUBS

Microsoft Excel
Microsoft Teams
Windows
Security, Compliance and Identity
Microsoft 365
Outlook
SharePoint
Azure
Exchange
Windows Server
Intune and Configuration Manager
Microsoft Viva
.NET
Sharing best practices for building any app with .NET.
Microsoft FastTrack
Best practices and the latest news on Microsoft FastTrack
Microsoft Sales Copilot
A role-based copilot designed for sellers


MOST ACTIVE HUBS

Education Sector
ITOps Talk
Microsoft Partner Community
AI and Machine Learning
Core Infrastructure and Security
Microsoft Mechanics
Healthcare and Life Sciences
Internet of Things (IoT)
Public Sector
Regional Blogs
Mixed Reality
Azure Partner Community
Expand your Azure partner-to-partner network
Microsoft Tech Talks
Bringing IT Pros together through In-Person & Virtual events
MVP Award Program
Find out more about the Microsoft MVP Award Program.


VIDEO HUB

Azure
Exchange
Microsoft 365
Microsoft 365 Business
Microsoft 365 Enterprise
Microsoft Edge
Microsoft Outlook
Microsoft Teams
Security
SharePoint
Windows
Browse All Community Hubs

Blogs

Blogs

Events

Events
 * Events Home
 * Microsoft Ignite
 * Microsoft Build
 * Community Events

Microsoft Learn

Microsoft Learn
 * Home
 * Community
 * Blog
 * Azure
 * Dynamics 365
 * Microsoft 365
 * Security, Compliance & Identity
 * Power Platform
 * Github
 * Teams
 * .NET


Lounge

Lounge
 * 1.2M Members
 * 7,970 Online
 * 309K Discussions

Search
Enter a search word

Turn off suggestions
Enter a search word

Turn off suggestions
Enter a user name or rank

Turn off suggestions
Enter a search word

Turn off suggestions
Enter a search word

Turn off suggestions
cancel
Turn on suggestions
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Sign In

Sign In





Enter a search word

Turn off suggestions
Enter a search word

Turn off suggestions
Enter a user name or rank

Turn off suggestions
Enter a search word

Turn off suggestions
Enter a search word

Turn off suggestions
cancel
Turn on suggestions
Showing results for 
Show  only  | Search instead for 
Did you mean: 


 * Home
 * Microsoft Edge Insider
 * Discussions
 * Msedge_proxy detected using sihost.exe tag as Behavioral threat "process
   spoofing" bu our cortex XDR

Skip to Topic Message


MSEDGE_PROXY DETECTED USING SIHOST.EXE TAG AS BEHAVIORAL THREAT "PROCESS
SPOOFING" BU OUR CORTEX XDR


Discussion Options
 * Subscribe to RSS Feed
 * 
 * Mark Discussion as New
 * Mark Discussion as Read
 * 
 * Pin this Discussion for Current User
 * Bookmark
 * Subscribe
 * 
 * Printer Friendly Page



lecksbush25
Copper Contributor

‎Oct 05 2022 09:16 AM

 * Mark as New
 * Bookmark
 * Subscribe
 * Mute
 * 
 * Subscribe to RSS Feed
 * 
 * Permalink
 * Print
 * 
 * Report Inappropriate Content

‎Oct 05 2022 09:16 AM


MSEDGE_PROXY DETECTED USING SIHOST.EXE TAG AS BEHAVIORAL THREAT "PROCESS
SPOOFING" BU OUR CORTEX XDR

Hi,

We recently identified (Monday, October 3, 2022) that there was being flagged as
a high behavioral threat by our endpoint protection (Cortex XDR) on multiple
computers across our organization; upon checking the incident case, All of them
are being executed by msedge_proxy.exe which chains its command to sihost.exe. I
want to know if this is a false positive and if it's normal or a bug. Please see
the details I can provide below:

 

Cortex Info:

 

Alert Name: Behavioral Threat

Source: XDR Agent

Category: Malware

Module: Behavioral Threat Protection

Severity: High

Description: Behavioral threat detected (rule: parent_process_spoofing) 

Action: Detected (Reported)

 

 

 

Process Information:

Command Line : "c:\program files
(x86)\microsoft\edge\application\msedge_proxy.exe"
--notification-launch-id=0|1|default|0|https://mail.google.com/|n#https://mail.google.com#fnjqw9hny8w/114987728825504974251
Original Command Line : "C:\Program Files
(x86)\Microsoft\Edge\Application\msedge_proxy.exe"
--notification-launch-id=0|1|Default|0|https://mail.google.com/|n#https://mail.google.com#FnJqW9hNy8w/114987728825504974251
File Name : msedge_proxy
Description : microsoft edge
Company : microsoft corporation
Copyright : copyright microsoft corporation. all rights reserved.
Original Name : msedge_proxy.exe
Signature Status : Signed
Singature Details : Valid
Signer : Microsoft Corporation
Loaded From TxF : 0
Parent PID : 15176
Image Path : c:\program files (x86)\microsoft\edge\application\msedge_proxy.exe
Image SHA256 : 89e4d5d11099e0667541e78977444ebe5d41e536f8c23403957d7da3be634f1f
Image MD5 : 131707b12b97b5a0e810dd7a0d4038dc
Effective SID : S-1-5-21-584199959-4099986459-2772195892-1168
From Remote Session : 0
Parent Thread ID : 4294967295
StartupInfo Parent PID : 9276
OS Parent PID : 9940

 

This is one of the computers reporting we detecting all triggering the endpoint
with the msedge_proxy.

 

 

 

 

 

 

 





5,003 Views
1 Like

2 Replies
Reply



undefined
 * All Discussions
 * Previous Discussion
 * Next Discussion


2 Replies
zer0trust
 replied to  lecksbush25

‎Oct 10 2022 06:44 AM

 * Mark as New
 * Bookmark
 * Subscribe
 * Mute
 * 
 * Subscribe to RSS Feed
 * 
 * Permalink
 * Print
 * 
 * Report Inappropriate Content

‎Oct 10 2022 06:44 AM


RE: MSEDGE_PROXY DETECTED USING SIHOST.EXE TAG AS BEHAVIORAL THREAT "PROCESS
SPOOFING" BU

@lecksbush25 We are also seeing this issue in our Cortex tenant on a few
computers. Any updates or additional information on this one?



0 Likes
Reply



CyberZealand
 replied to  lecksbush25

‎Oct 10 2022 02:09 PM

 * Mark as New
 * Bookmark
 * Subscribe
 * Mute
 * 
 * Subscribe to RSS Feed
 * 
 * Permalink
 * Print
 * 
 * Report Inappropriate Content

‎Oct 10 2022 02:09 PM


RE: MSEDGE_PROXY DETECTED USING SIHOST.EXE TAG AS BEHAVIORAL THREAT "PROCESS
SPOOFING" BU

We've also encountered a similar form of issue. I'd recommend looking closely at
content version of the machine at the time of alert.

Palo Alto Support: "I would like to inform you that, these are False positives
and also there is a fix release on the content update 710-19689. From the logs I
can see that you are in content update 710-19496 that is why you are getting
these alerts."


1 Like
Reply



undefined


SHARE

 * Share to LinkedIn
 * Share to Facebook
 * Share to Twitter
 * Share to Reddit
 * Share to Email





Browse

Skip to Primary Navigation
What's new
 * Surface Pro 9
 * Surface Laptop 5
 * Surface Studio 2+
 * Surface Laptop Go 2
 * Surface Laptop Studio
 * Surface Duo 2
 * Microsoft 365
 * Windows 11 apps

Microsoft Store
 * Account profile
 * Download Center
 * Microsoft Store support
 * Returns
 * Order tracking
 * Virtual workshops and training
 * Microsoft Store Promise
 * Flexible Payments

Education
 * Microsoft in education
 * Devices for education
 * Microsoft Teams for Education
 * Microsoft 365 Education
 * Education consultation appointment
 * Educator training and development
 * Deals for students and parents
 * Azure for students

Business
 * Microsoft Cloud
 * Microsoft Security
 * Dynamics 365
 * Microsoft 365
 * Microsoft Power Platform
 * Microsoft Teams
 * Microsoft Industry
 * Small Business

Developer & IT
 * Azure
 * Developer Center
 * Documentation
 * Microsoft Learn
 * Microsoft Tech Community
 * Azure Marketplace
 * AppSource
 * Visual Studio

Company
 * Careers
 * About Microsoft
 * Company news
 * Privacy at Microsoft
 * Investors
 * Diversity and inclusion
 * Accessibility
 * Sustainability

 * Sitemap
 * Contact Microsoft
 * Privacy
 * Manage cookies
 * Terms of use
 * Trademarks
 * Safety & eco
 * About our ads
 * © Microsoft 2023

Auto-suggest helps you quickly narrow down your search results by suggesting
possible matches as you type.

Auto-suggest helps you quickly narrow down your search results by suggesting
possible matches as you type.