Endpoint connector 7.5.3.20938 flagging every service start as IOC

davalosn — Mon, 04 Apr 2022 19:54:19 GMT

Just about every service start command is being flagged as an IOC right now. I've gotten around 30 or 40 alerts in the last hour for normal service starting behavior, some examples:

C:\Windows\system32\svchost.exe -k localService -p -s RemoteRegistry

C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

All these are getting flagged: Cloud IOC: ExecutedMalware.ioc

These are all normal service startup commands.

Re: Endpoint connector 7.5.3.20938 flagging every service start as IOC

Ken Stieers — Mon, 04 Apr 2022 21:41:54 GMT

All FPs.

Check your Announcements panel in the console.

topic Endpoint connector 7.5.3.20938 flagging every service start as IOC in Endpoint Security

Endpoint connector 7.5.3.20938 flagging every service start as IOC

Re: Endpoint connector 7.5.3.20938 flagging every service start as IOC