May I ask what happened? Detected on the computer ：C2_9a (T1095 mem/meter-e) 、 Disrupt_2a (T1574.002)

Hi ong！ L ,

Thank you for reaching out to the Sophos Community Forum.

Can you share more details about this detection, please? You can also go to Sophos Central and check the Events tab on the computer's details page, and let us know what you find.

The "Disrupt" detections are related to our Adaptive Attack Protection. These typically indicate an active, hands-on attack within your environment. Please see the knowledgebase article at https://support.sophos.com/support/s/article/KB-000044367?language=en_US and take immediate action. If you need assistance evaluating the impact of the attack or responding to an incident, you may reach out to your partner or contact Sophos Incident Response Services.