WIN-EVA-PRC-NET-STOP-SOPHOS-1

Thank you for reaching out to the community forum.

On your central dashboard, do you see a Parent for Net.EXE? 
Also, Can you raise a support case regarding this detection and share with us the case ID? 

Hi Glenn,
I've raised a case as requested and its number is 02172435. I've added the RAW_Log from one of the detections to the suppoort case as well as enabling Remote Assistance.

The Parent seems to be either Taskeng.exe OR svchost.exce for all these Detections.

Thanks.

Andy.

Hi Glenn,
I've raised a case as requested and its number is 02172435. I've added the RAW_Log from one of the detections to the suppoort case as well as enabling Remote Assistance.

The Parent seems to be either Taskeng.exe OR svchost.exce for all these Detections.

Thanks.

Andy.

Thank you, Andy. It looks like you have a running scheduled task trying to kill the process, which triggers this multiple detection. 
You can try checking it to validate further, or you can check a Live query and see what scheduled task is running on your devices.

Hi Glenn,
Thanks for the pointer. Looks like we have a very old GPO that attempts to Stop & Start this service. I have a vague recollection this was done many years ago to purge old logs or data due to a known fault in that Sophos Service at the time.

We're going to remove this GPO. Thanks for your help. I'll update and cancel the ticket.

Andy.