MDATP DarkGate False Positives

Hey guys,

Has anyone else seen MDATP flagging cmd.exe as DarkGate malware on SQL servers? The file hashes come back clean and there are no events to indicate potential compromise. I know they recently posted an article on a new attack vector for lateral movement from SQL servers to cloud. So maybe the detection rules are still being tweaked. [https://www.microsoft.com/en-us/security/blog/2023/10/03/defending-new-vectors-threat-actors-attempt-sql-server-to-cloud-lateral-movement/](https://www.microsoft.com/en-us/security/blog/2023/10/03/defending-new-vectors-threat-actors-attempt-sql-server-to-cloud-lateral-movement/)

Would just like to confirm we aren't the only ones seeing this.

cybersecurity darkgate false positives hey