Reply to thread

Message: <blockquote data-quote="simmerskool" data-source="post: 1044290" data-attributes="member: 61091">I received an email from Cyberforce support re the above Di suspicious event:"If this has been identified as a legitimate process, then we can consider it a False Positive and add to the allow list.  As for why some days and not others, it seems to be showing up every other day in the event list but each event has 2 occurrences.  If the same event occurs more than once in a 24 hour period then its occurrence count is incremented so as to not inundate a person with multiple events.  This event is being considered suspicious because it is mapping to a mitre attack.  Not every mitre attack is bad but could be and that is why it is flagged as suspicious. These are usually seen to help identify possibly third party attacks."</blockquote>

Top