SentinelOne flagging Jetbrains Toolbox for "peristence_deception"

Avatar
Mobile
Created

SentinelOne is quarantining jSpawnhelper for persistence_deception.  Latest version, knocks it out as soon as it runs. 

Votes

3

Share

5 comments
Avatar
Ivan Kuzmin
Created

Hi Mobile. Sorry for the inconvenience. We will look into it. By the latest version, do you mean Toolbox App 1.28.1, released yesterday?

 

0
Avatar
Chris
Created

seeing the same issue today in version

JetBrains Toolbox 2.0.1.16621, macOS 13.4.1

2
Avatar
Owen Gerrard
Created

Same here, /Applications/JetBrains Toolbox.app/Contents/MacOS/jetbrains-toolbox flagged with "Detected suspicious running process" for "persistence_deception".

JetBrains Toolbox 2.0.1.16621, macOS 13.4.1

SentinelOne Version 22.2.3.6268

1
Avatar
Mark B
Created

Same again here, warning is for /Applications/JetBrains Toolbox.app/Contents/MacOS/jetbrains-toolbox, on Sonoma

1
Avatar
Ivan Kuzmin
Created

Thanks for letting us know. It could be related to the Launch Toolbox App at system startup option, which is enabled by default. 

Toolbox App indeed runs in the background to keep track of the available updates.

 

 


 

0

Please sign in to leave a comment.