Lockdown preventing valid application from running

Question

I have an application that was updated and now Sophos is blocking it from running. In the Win10 Event Viewer, HitmanPro.Alert Events, I see Mitigation: Lockdown on application javaw.exe. The actual application is a java app that is called from a web browser. If I remove Sophos from the PC, it works perfectly. I have tried a mix of global exclusions and local policy exclusions and nothing appears to have any affect on the computer. 
 If I look in the Threat Analysis Center, the processes listed are chrome.exe, zcchelper.exe, and javaw.exe. But file exceptions for zcchelper.exe and javaw.exe don't help. 
 Any suggestions for fixing this? At this point, I am planning to remove Sophos from my Management PC so I can do my job. I've been running Sophos AV for ages and this is the first time I have ever had it prevent me from actually doing legitimate work. It is a bit frustrating. 
 Thanks in advance for any help. Ken

MEric · Accepted Answer

Hi Ken, 
 If a Java app is being called from a web browser I suspect the feature may be working as expected. 
 In terms of creating an exclusion, a file/folder exclusion will not work as this type of exclusion is for Anti-virus while Intercept X is causing the block. 
 If you check Event Viewer again and review these Event ID 911's, are the thumbprints at the bottom changing? If not a simple exclude from the endpoint's events in Sophos Central should do the trick (Detected Exploits exclusion.) 
 If the thumbprint is constantly changing we would have to create a more general exclusion. Clone your Threat Protection policy and apply it only to you, then either disable "Protect Java applications" under "Mitigate exploits in vulnerable applications". The other option is to create a global Exploit Mitigation exclusion for Java but this would be for your entire company.

Ken Etter · Answer

So rather than disabling "Protect Java applications", Sophos support worked with me and we found that making an Exploit Mitigation exception for gptool.exe, javaw.exe, and zcchelper.exe was sufficient. I'm not sure if all three are necessary, but it definitely works this way. A little trial and error might narrow it down to just one or two of them.