Sandboxie-Plus 1.10.2 false positives

[deeperfacts]

[bastik-1001]

Those are most likely false positives, due to the circumstance of the installer for the pre-release not being signed.

To a degree it is valid to find that suspicious, since some unsigned installer tries to install a driver (that is signed) and there is a history of signed installers, if any vendor ever keeps track of this. For an installed security solution, it may also look suspicious that an installer replaces previously signed files with unsigned files, if there is an upgrade installation.

[bastik-1001]

The rule for "sandboxdetect" should be triggered by the installer as it detects if Sandboxie is active.

The rule about "taskkill" is triggered as this tool gets executed to terminate processes that are running (like sandman.exe) to install a newer version.

BTW, I don't know what naming scheme is applied by CrowdStrike Falcon, but including "confidence_100%" in the string, better be accurate.

[deeperfacts]

@bastik-1001 Thank you for explanations.