draw.io desktop accessing private and process memory

[GeoNicole]

Hi folks,

I'm new to this discussions thing, so please let me know if this post should go elsewhere. (also the huntr page is not working right now)
I've been using Draw.io for years and love it. However, our new antivirus and anti-phishing programs at work are flagging it now, as something appears to be accessing credentials of background apps which are open.

Our temporary low-tech solution is to 1) limit what applications are open when using draw.io or 2) use the web version.
Has anyone else run into this? Is there a valid/advertising reason this is being accessed?

Thanks,
Nicole

[davidjgraph]

Hi,

• what's the name of the software that is flagging draw.io?
• what operating system are you using and what version of draw.io?
• can we please see a bigger screenshot, how does the software indicate that it's draw.io doing this?

[GeoNicole]

Antivirus is SentinelOne - it's an AI powered one. Our IT is reaching out to them as well to see if he can get more info.
The rest of the detail is below
Draw.io was version 24.4.something... I think it was .2 It happened when I was attempting to update and then again after reinstallation while I was using it with both Chrome and KeePass open in the background

[davidjgraph]

Do you have a link to the KeePass app that you run?

I wonder if it's getting confused because draw.io is an electron app, which is basically Chrome wrapped up.

[GeoNicole]

I mean, theoretically maybe, but I highly doubt it as I don't have any plugins or browser extensions for KeePass.
https://keepass.info/

[davidjgraph]

Yeah, I'm not really sure how this could be detected, but my knowledge of windows is limited.

There's been an uptick is false positives against us, I guess just more and more software is coming up in this field. SentnelOne support are the only ones that can answer why the think we're accessing chrome on the system.

[GeoNicole]

Thanks for looking into this! I'll let you know what we hear from SentinelOne as well!