Temporarily disabled system-wide Syscall mitigation as certain third-party security products, like Cylance, actually attempt to bypass API calls by directly jumping to kernel functions via a syscall. The fix appears to be incompatible with many game launchers that actually perform main thread hijacking. Temporarily disabled the fix that detects Cobalt Strike delivery over SMB. Improved compatibility of CookieGuard with browsers that are attached to the Office mitigation profile

Fixed a potential security issue where specifically crafted malware on the machine could craft and manipulate a file structure to elevate privileges Fixed an issue with three CryptoGuard 5 Thumbprints that were not working in the previous build Fixed more compatibility issues between process hollowing and certain games You can find in in the Advanced interface, under Risk reductions > Process Protection > Unexpected system calls (Stop evasion of security hooks). Added checkbox to our new system-wide syscall mitigation. Added Thumbprint generation for remote-debugging-port CookieGuard detection Improved detection of Chromium-based web browser for CookieGuard Improved Stack Pivot exploit mitigation to support adjacent stack range in certain situations We noticed that since build 895 we always shipped the ARM64 driver of that release. Fixed an issue in the CryptoGuard anti-ransomware engine that could cause a BSOD on Windows 10 Insider Build 21390 This issue caused our new CookieGuard protection to generate false alarms. Fixed the Software Radar that could cause it to not notice a just installed web browser, or adding it to the wrong mitigation template.

This new mitigation will return in an upcoming release. Temporarily removed the system-level Syscall mitigation due to compatibility issues with some third-party security software. Fixed a crash that could occur in Microsoft Office 365 Changed Re-enabled global Syscall mitigation. Compatibility with Visual Studio triggering alerts HollowProcess (Main Thread Hijack MTH) mitigation to detect Cobalt Strike Beacon installing over SMB Benefits Info button now lands on the correct page Compatibility with Windows CET (Shadow Stack) Small memory leak that occurred when switching CryptoGuard modes Compatibility of Enforce DEP with Norton Security Extended information in alert when CookieGuard detects cookie grab by untrusted code in a web browser, e.g., hashes of remote owner process and owner module LockdownLoadImage mitigation to applications under the Office protection category mitigates e.g. Change log not available for this version

Hitmanpro alert 3