For the last few hours we have been seeing an increasing number of 'Powershell command in registry data' findings.
They all look the same and report something similar:
Observables
| File: | taskhostw.exe e6370920…58402728 |
| Registry Key: | \USER\S-1-5-21-1514197063-1296195755-1265796959-7856\SOFTWARE\Microsoft\Windows\CurrentVersion\AppListBackup\ListOfTaskBackedUpTiles_2361862998 ListOfTaskBackedUpTiles_2360852998 |
Observed Activity
| Registry Set | \USER\S-1-5-21-1514197063-1296195755-1265796959-7856\SOFTWARE\Microsoft\Windows\CurrentVersion\AppListBackup\ListOfTaskBackedUpTiles_2361862998 |
I assume this is nothing to worry about? Is there a way to prevent this particular alert message or do we have to wait for a signature update?
