So, you really don't need to worry about Outlook. The malicious element was the email. Has that been removed? As for the other elements - the endpoint detected the action and stopped it - that is the only…
As QC says, we need to clarify if this is a Threat Case in Sophos Central. If it is, and you are seeing Outlook as the root node in the case - then your infection vector was an email and someone clicked on it and it did the malicious actions.If this isn't a Threat Case in your Central Dashboard - please post a screenshot of what you are referencing.
Hi,
Sorry about that, i should have clarified about it. Yes it is generated through the threat analysis, and like you said "Outlook as the root node in the case - then your infection vector was an email and someone clicked on it and it did the malicious actions", you are correct, but since there has been many files and registry keys that has been affected by it, how should I go about it.
So, you really don't need to worry about Outlook. The malicious element was the email. Has that been removed? As for the other elements - the endpoint detected the action and stopped it - that is the only way you get a Threat Case. So, what you want to do now is go take a look at the items touched before the actions were stopped. Were there any network calls to other machines in your environment - if yes, are those machines protected by Sophos? Where there any calls to external resources that could be CnC servers? If yes, what happened at your firewall? Were any critical system or data files touched? If yes, verify the contents and signatures.I would also suggest you do a full system scan with the Sophos Endpoint on the reporting machine - just to make sure there isn't any lingering bits sitting around.
RichardP Thank you very much all you help, this has been really helpful and I am grateful.