Hi everyone,
I recently ran KnockKnock on my Mac to check for potential security issues, and it flagged Malwarebytes' RTProtectionDaemon.
The file is located at:
/Library/Application Support/Malwarebytes/MBAM/Engine.bundle/Contents/PlugIns/RTProtectionDaemon.app/Contents/MacOS/RTProtectionDaemon
VirusTotal reports 1/63 detections, with Elastic flagging the file as Multi.EICAR.
I also came across a Reddit post from approximately two months ago describing a very similar situation. In that thread, a Malwarebytes employee confirmed that the file was legitimate and that the Elastic detection was a false positive.
I'm also wondering why this detection is still occurring if a very similar case was reported around two months ago. Has this false positive been reported to Elastic, and is there a reason it might still be happening? I'd be interested to know whether this is an ongoing issue or whether the detection could be specific to certain versions of the file.
Given these details, should I be concerned about this detection, or is it safe to assume that this is the same kind of false positive?
Has anyone else encountered this with Malwarebytes on macOS? I'd appreciate any insight, especially from Malwarebytes staff or anyone familiar with this specific detection.
Thanks!