topic Re: Security event in General Topics

Security event

BigPalo — Thu, 23 May 2019 09:56:28 GMT

We have a security event that is repeated in a series of users, Not many users but the event is very frequent

---------------------

EVENT
Memory Corruption Exploit
AGENT TIME
21 May, 2019 at 6:08 (2 hours ago)
AGENT LOCAL TIME
21 May, 2019 at 6:08 (UTC +02:00) (2 hours ago)
REPORT TIME
21 May, 2019 at 6:10 (2 hours ago)
EVENT ID
ec66f123488b4f65a80648166e0581f1COMMAND LINE
C:\Windows\system32\svchost.exe -k netsvcs
PID
6208
PARENT PID
2644
FILE NAME
svchost.exe
FULL PATH
C:\Windows\SysWOW64\svchost.exe
FILE SIZE
20.5 KB
SHA 256
121118A0F5E0E8C933EFD28C9901E54E42792619A8A3A6D11E1F0025A7324BC2
SIGNER
Microsoft Windows

---------------

what that means? any way to solve it or delete these repetitive events?

Re: Security event

reaper — Thu, 23 May 2019 10:24:04 GMT

are you on traps 5.0.6?

Re: Security event

BigPalo — Thu, 23 May 2019 12:50:01 GMT

version is 5.0.5.

Re: Security event

BigPalo — Mon, 27 May 2019 06:36:30 GMT

any idea, how to delete this event??

Re: Security event

reaper — Mon, 27 May 2019 12:07:20 GMT

You could try upgrading to 5.0.6, or reach out to TAC to see if this issue can be resolved otherwise