Endpoint connector 7.5.3.20938 flagging every service start as IOC

[davalosn]

Just about every service start command is being flagged as an IOC right now. I've gotten around 30 or 40 alerts in the last hour for normal service starting behavior, some examples:

C:\Windows\system32\svchost.exe -k localService -p -s RemoteRegistry

C:\Windows\System32\svchost.exe -k NetSvcs -p -s NcaSvc

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

All these are getting flagged: Cloud IOC: ExecutedMalware.ioc

These are all normal service startup commands.

[Ken Stieers]

All FPs.  

Check your Announcements panel in the console.