Help - We are getting hundreds of Defender alarms "Sadaco Malware was prevented"

Hi guys,

since last friday we are getting hundreds alarms "Sadoca malware was prevented".

Those are all false positives. This concerns an Excel macro that is widely used in our company. The macro is found in a large number of Excel files located in various locations (local, networkdrive, onedrive etc.).

Whats the best approach on allowing this specific macro without completely allowing the Sadoca threat?

Posted Mar 4, 2026, 7:29 AM UTC

79
Loading comments…