https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/anti-tampering-protection/m-p/1222366#M7990 <P>Hello,&nbsp;</P> <P>I got incident with Anti-tampering protection which was blocked, i reviewed the alert by CMD C:\WINDOWS\system32\svchost.exe -k GPSvcGroup</P> <P>it it false postive?<BR />any ideas?</P> <P>&nbsp;</P> <P><LI-PRODUCT title="Cortex XDR" id="Cortex_XDR"></LI-PRODUCT>&nbsp;</P> Mon, 03 Mar 2025 03:08:44 GMT SeanDeHarris 2025-03-03T03:08:44Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/anti-tampering-protection/m-p/1222366#M7990 <P>Hello,&nbsp;</P> <P>I got incident with Anti-tampering protection which was blocked, i reviewed the alert by CMD C:\WINDOWS\system32\svchost.exe -k GPSvcGroup</P> <P>it it false postive?<BR />any ideas?</P> <P>&nbsp;</P> <P><LI-PRODUCT title="Cortex XDR" id="Cortex_XDR"></LI-PRODUCT>&nbsp;</P> Mon, 03 Mar 2025 03:08:44 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/anti-tampering-protection/m-p/1222366#M7990 SeanDeHarris 2025-03-03T03:08:44Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/anti-tampering-protection/m-p/1222383#M7994 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/184443">@SeanDeHarris</a>&nbsp;,</P> <P>&nbsp;</P> <P><SPAN>Thanks for reaching out on LiveCommunity!</SPAN></P> <P>&nbsp;</P> <P><SPAN>I would suggest, involving your AD Team here and identify why SVC host and done this in group policy client.</SPAN></P> <P>&nbsp;</P> <P><SPAN>If needed , please involve TAC too.</SPAN></P> <P>&nbsp;</P> <P><SPAN>If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.</SPAN></P> Mon, 03 Mar 2025 07:44:41 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/anti-tampering-protection/m-p/1222383#M7994 aspatil 2025-03-03T07:44:41Z