Hello,
I have 100+ Detections on the Threat Analysis Dashboard for a Medium Severity WIN-EVA-PRC-NET-STOP-SOPHOS-1 that occurred yesterday, mostly within minutes of each other. Looking at the RAW Data tab it seems these all share the same command line being detected:
"C:\WINDOWS\system32\NET.EXE\" STOP SophosDataRecorderService",
I'm guessing this is as a result of a maintenance task on Data Recorder rather than anything malicious but cant locate any Event or Log entries that may give further details. I see no other noteworthy Detections in Central for this time period. Can anybody point me in the right direction please to investigate this further?
Many thanks.
Andy.
Thank you for reaching out to the community forum.
On your central dashboard, do you see a Parent for Net.EXE?
Also, Can you raise a support case regarding this detection and share with us the case ID?
Thank you, Andy. It looks like you have a running scheduled task trying to kill the process, which triggers this multiple detection.
You can try checking it to validate further, or you can check a Live query and see what scheduled task is running on your devices.
Quote