Issue #1: False Positive detection of ntoskrnl.exe by Behavior Monitoring

Cause: A compatibility issue was identified with the pre-existing Policy Enforcement Pattern and the latest Behavior monitoring engine included on the May 2024 update.

Solution: Updating to Policy Enforcement Pattern build 1.260.00 (now available on Trend Micro ActiveUpdate (AU) server on 22-May-2024 17:07 UTC+0) should resolve this issue.
 

Issue #2:  High CPU experienced on some endpoints with DLP enabled

Cause: This issue was found to be introduced in the March 2024 maintenance build where monitoring requests could abnormally queue and accumulate within the Windows System Kernel.  The resolution for this issue was included in the recent May 2024 maintenance build; however, in some cases it was observed that the unloading of the old module during the update process could trigger high CPU due to clearing the oversized queue.

Solution: The abnormal queue issue is resolved in the May 2024 maintenance build, and endpoint clients experiencing high CPU may require a system reboot if the service cannot be restarted normally. 

For further support assistance, please contact Trend Micro Technical Support.