Security News > 2021 > December > Microsoft Defender Log4j scanner triggers false positive alerts
Microsoft Defender for Endpoint is currently showing "Sensor tampering" alerts linked to the company's newly deployed Microsoft 365 Defender scanner for Log4j processes.
The alerts are reportedly mainly shown on Windows Server 2016 systems and warn of "Possible sensor tampering in memory was detected by Microsoft Defender for Endpoint" created by an OpenHandleCollector.
While this Defender process' behavior is tagged as malicious, there's nothing to worry about since these are false positives, as revealed by Tomer Teller, Principal Group PM Manager at Microsoft, Enterprise Security Posture.
Microsoft is currently looking into this Microsoft 365 Defender issue and working on a fix that the company should soon deliver to affected systems.
As Microsoft shared on Tuesday, this newly deployed Log4j scanner was rolled out with a new consolidated Microsoft 365 Defender portal Log4j dashboard for threat and vulnerability management.
Since October 2020, Windows admins had to deal with other Defender for Endpoint, including one that marked Office documents as Emotet malware payloads, one that showed network devices infected with Cobalt Strike, and another that tagged Chrome updates as PHP backdoors.