{"id":4418,"date":"2026-06-08T17:52:52","date_gmt":"2026-06-08T14:52:52","guid":{"rendered":"https:\/\/support.withsecure.com\/en\/?post_type=support_article&p=4418"},"modified":"2026-06-08T17:52:52","modified_gmt":"2026-06-08T14:52:52","slug":"deepguard-prevented-an-untrusted-application-from-modifying-another-process","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/deepguard-prevented-an-untrusted-application-from-modifying-another-process\/","title":{"rendered":"DeepGuard prevented an untrusted application from modifying another process"},"content":{"rendered":"

Issue:<\/h3>\n

A DeepGuard Security alert is sent to the Elements Endpoint Protection portal's Security events\u00a0<\/b>list or Policy Manager Console's Alerts<\/b> list.<\/p>\n

Example:\u00a0<\/p>\n

Security alert: DeepGuard prevented an untrusted application from modifying another process.
Details: DeepGuard prevented an untrusted application from modifying another process. Application path: C:\\Program Files\\exampleprogram\\examplefile.exe File hash: 2179dde55137b4a228135af0b45acc7752e13e15<\/p>\n

Can this be a false positive and can the file be excluded?\u00a0<\/p>\n

Resolution:<\/h3>\n

DeepGuard is equipped with a self-protection feature where it prevent any process from terminating WithSecure's processes. DeepGuard monitors the OpenProcess <\/strong>function, which is used by the program to access the WithSecure process information with a termination rights.
\u00a0
When DeepGuard detects that the program is trying to open a WithSecure process with the PROCESS_TERMINATE<\/strong> flag, it shows a block message and removes the flag, preventing the ability of the program from terminating the process.<\/p>\n

This alerts will not affect the functionalities of the accessor program as DeepGuard only removes the termination rights, hence made the OpenProcess<\/strong> called more safe towards WithSecure processes.<\/p>\n

If you want to make sure it is not a false positive, you can open a submit a sample<\/a> ticket.<\/p>\n

If you are absolutely sure it to be a false positive and you do not want to have the alert shown, as a workaround you can exclude the program directly by using its path + filename or by excluding the SHA1 value shown in the alert.\u00a0<\/p>\n

Follow these steps to add an exclusion:<\/p>\n

For Business Suite (Client Security and Server Security) using Policy Manager policy:<\/p>\n

    \n
  1. Log in to the Policy Manager Console<\/li>\n
  2. Select a policy domain or host from the Domain Tree<\/li>\n
  3. Go to the\u00a0Settings\u00a0<\/b>tab<\/li>\n
  4. Go to the\u00a0Real-time scanning\u00a0<\/b>settings<\/li>\n
  5. Scroll to the Files\u00a0and<\/b>\u00a0applications excluded from scanning\u00a0<\/b>table and enable\u00a0Do not scan the following files and applications\u00a0<\/b><\/li>\n
  6. Click\u00a0Add<\/b><\/li>\n
  7. Set the scope as\u00a0All scans\u00a0<\/b>and select\u00a0File path\u00a0<\/b>from the drop-down menu<\/li>\n
  8. Add the file path\u00a0C:\\Program Files\\Exampleprogram\\examplefile.exe\u00a0<\/b>and click OK<\/b><\/li>\n
  9. Distribute the policy (Ctrl + D)<\/li>\n<\/ol>\n

    For Elements Endpoint Protection (EPP for Computers and EPP for Servers) using portal profile:<\/p>\n

      \n
    1. Log in to the Elements Security Center: https:\/\/elements.withsecure.com<\/a><\/li>\n
    2. Open the\u00a0Security configurations\u00a0<\/strong>section from the menu on the left<\/li>\n
    3. Go to the\u00a0Profiles\u00a0<\/b>page<\/li>\n
    4. Choose the\u00a0profile which the device is using<\/li>\n
    5. Go to the\u00a0General settings<\/b>\u00a0page<\/li>\n
    6. Scroll down to the\u00a0Exclude folders and files from all security scans\u00a0<\/b>section and click\u00a0Add exclusion<\/b><\/li>\n
    7. In the Path field add the:\n
        \n
      • Full path for the application if you want to exclude a specific application<\/li>\n
      • Folder path if you want to exclude a folder and its sub folders<\/li>\n<\/ul>\n<\/li>\n
      • Click\u00a0Save and publish<\/b><\/li>\n<\/ol>\n

        The SHA-1 can also be added manually to the DeepGuard protection rules. Follow the steps below to manually add an SHA-1 exclusion in DeepGuard:<\/p>\n

          \n
        1. Log in to the Elements portal<\/li>\n
        2. Open the\u00a0Security Configurations\u00a0<\/strong>section from the menu on the left<\/li>\n
        3. Select the\u00a0Profiles\u00a0<\/b>tab\u00a0on the left<\/li>\n
        4. Select the profile you want to add the exclusion to<\/li>\n
        5. Select\u00a0Real-time scanning<\/b>\u00a0on the left<\/li>\n
        6. Scroll down to\u00a0DeepGuard protection rules<\/b><\/li>\n
        7. Click on\u00a0Add rule<\/b><\/li>\n
        8. Fill in the SHA1-hash and a\u00a0note about the application<\/li>\n
        9. Click\u00a0Save and Publish\u00a0<\/b><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

          The following Security alert is sent to the Policy Manager Console alerts list:\u00a0<\/p>\n

          Security alert: DeepGuard prevented an untrusted application from modifying another process.
          \nDetails: DeepGuard prevented an untrusted application from modifying another process. Application path: C:\\Program Files\\Microsoft Monitoring Agent\\Agent\\HealthService.exe File hash: 2179dde55957b4a228135af0b15acc7752e13e15<\/p>\n

          Is this a false positive and can the file be excluded?\u00a0<\/p>\n","protected":false},"template":"","support_article_product":[104],"class_list":["post-4418","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000014140","source_version":3,"source_system":"salesforce","source_date_updated":"2026-06-08 14:52:52","import_hash":"6ebdad485bc005912b6279b476781a33ab2a26ef","vanilla_article_id":31296,"vanilla_url":"https:\/\/community.withsecure.com\/en\/kb\/articles\/31296-deepguard-prevented-an-untrusted-application-from-modifying-another-process","vanilla_kb_id":30,"vanilla_category_id":106,"machine_translated":false,"reactions_helpful_yes":0,"reactions_helpful_no":0},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/4418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4418"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=4418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}