Exploit.PayloadProcessBlock when clicking links from Office docs

[DoogleSmile]

I've just started getting "Advanced Threat Protection" popups from Office when I click on links I know are safe. This is a new bug created by Office if you have an enterprise license and it hasn't been set up properly to allow links.

However, if I click to skip verification to load the link, then Malwarebytes forces Excel to close and pops up the following (It does this with every link in the document):

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 04/12/2023
Protection Event Time: 15:57
Log File: d21300fc-92bd-11ee-84ff-00d8617830f9.json

-Software Information-
Version: 4.6.6.294
Components Version: 1.0.2201
Update Package Version: 1.0.77978
Licence: Premium

-System Information-
OS: Windows 10 (Build 19045.3693)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Exploit.PayloadProcessBlock, C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --single-argument https:\www.walescottageholidays.co.uk\snowdonia-the-llyn-peninsula\llanbedrog-cottages\thefor-the-forge, Blocked, 701, 392684, 0.0.0, , 

-Exploit Data-
Affected Application: Microsoft Office Excel
Protection Layer: Application Behavior Protection
Protection Technique: Exploit payload process blocked
File Name: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --single-argument https:\www.walescottageholidays.co.uk\snowdonia-the-llyn-peninsula\llanbedrog-cottages\thefor-the-forge
URL: 

(end)

I can copy and paste the line "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe C:\Program Files (x86)\Google\Chrome\Application\chrome.exe --single-argument https:\www.walescottageholidays.co.uk\snowdonia-the-llyn-peninsula\llanbedrog-cottages\thefor-the-forge" into a command prompt and it works fine to open the page up.

Is there anything I can do to fix this issue? I'm able to simply copy the links and paste them into my browser window in the mean time.

[Porthos]

Do you have the following enabled in the advanced exploit settings section?

[DoogleSmile]

No, that is disabled in my settings.

[Porthos]

I am going to ask @Arthi to offer a fix for you. For now, work around it as you are doing.

[Porthos]

I personally do not use Chrome as my default browser and I can not reproduce it with Firefox as my default.

[DoogleSmile]

I just changed my default browser to firefox, and I get the same issue:

Malwarebytes
www.malwarebytes.com

-Log Details-
Protection Event Date: 04/12/2023
Protection Event Time: 16:48
Log File: 034dc808-92c5-11ee-953b-00d8617830f9.json

-Software Information-
Version: 4.6.6.294
Components Version: 1.0.2201
Update Package Version: 1.0.77978
Licence: Premium

-System Information-
OS: Windows 10 (Build 19045.3693)
CPU: x64
File System: NTFS
User: System

-Exploit Details-
File: 0
(No malicious items detected)

Exploit: 1
Exploit.PayloadProcessBlock, C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe -osint -url http:\www.google.co.uk\, Blocked, 701, 392684, 0.0.0, , 

-Exploit Data-
Affected Application: Microsoft Office Excel
Protection Layer: Application Behavior Protection
Protection Technique: Exploit payload process blocked
File Name: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe -osint -url http:\www.google.co.uk\
URL: 

(end)

[Porthos]

Try resetting the advanced exploit protection to default and click apply.

[DoogleSmile]

That fixed it, thank you!

 

 

[Arthi]

Hi DoogleSmile,

You most likely had the below non-default setting ON. Glad, it is resolved with restoring to defaults. Thanks for posting.