Process name collision for Cisco Secure Endpoint (Formerly Cisco AMP) about edrsilencer

[netero1010]

Thank you for bringing this to my attention. I will initially leave this issue open, as the auto-blocking feature is designed to check only actively running processes. It appears that C:\Windows\System32\sfc.exe is not commonly used as a long-term running process.

However, I do recognize the possibility of a process name collision. Should I receive more reports of similar cases, I will consider updating the code to include the additional checks (e.g., check full path for key words or check if the process is antimalware protected process light).

[logdumpster]

Can either add a second check for the path or just ignore this as it probably doesn't matter that much