[Bug]: Antivirus Trigger - Crowdstrike Falcon

[GregFurnival]

Preflight Checklist

• I have read the Support Disclaimer for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a bug report that matches the one I want to file, without success.
• I have read the troublshooting FAQs and none solved my issue.

Cider Version

2.1

What operating system are you using?

Windows

Operating System Version

Windows 11 22H2 (OS Build 22621.1992)

Where did you download Cider from?

Microsoft Store

Describe the Bug

Tripped Crowdstrike Antivirus after installing Cider (Preview) from Windows Store.

Detect time: Aug. 1, 2023 07:07:56

Host Type: Workstation

Action Taken: File quarantined

Severity: Medium

Objective: Falcon Detection Method

Tactic & technique: Machine Learning via Sensor-based ML

Technique ID: CST0007

IOA Name: Machine Learning Identified Medium Confidence Malicious File

IOA Description: A file written to the file system meets the on-sensor machine learning medium confidence threshold for malicious files. Detection is based on a high degree of entropy, packing, anti-malware evasion, or other similarity to known malware.

Triggering Indicator: Associated IOC (SHA256 on file write)
7c1cdf41c9dae182dfdea050a4b3b2841b14cdb614746d1306062574973da8fd

Global prevalence: Common
Local prevalence: Unique

IOC Management Action: None

Associated File: \Device\HarddiskVolume5\Program Files\WindowsApps\27554FireDevElijahKlauman.CiderEA_2.1.0.0_x64__270bejk4xgzqp\VFS\ProgramFilesX64\Cider\airtunes2.exe

Local Process ID: 17436

Command Line: C:\WINDOWS\system32\svchost.exe -k wsappx -p -s AppXSvc

File path: \Device\HarddiskVolume5\Windows\System32\svchost.exe

Executable SHA256: 949bfb5b4c7d58d92f3f9c5f8ec7ca4ceaffd10ec5f0020f0a987c472d61c54b

Steps to Reproduce

Installed Cider (Preview) from windows store and attempted to start it. Antivirus quarantined it.

Windows 11 22H2 (OS Build 22621.1992)

Anything else?

https://www.virustotal.com/gui/file/7c1cdf41c9dae182dfdea050a4b3b2841b14cdb614746d1306062574973da8fd/detection

[github-actions]

Support for Cider 1.0 is in a reduced state. Do not expect replies or acknowledgement for issues that do not break full functionality of the app (Media playback, plugin functionality etc.).

If you are interested in joining the Cider 2 open alpha, you can join our Discord here.

[github-actions]

This issue is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 7 days.