We are getting lot of Ransomware access control alerts caused by Elements Endpoint Protection feature DataGuard,\u00a0 which is blocking C:\\Windows\\System32\\svchost.exe
What is the root cause of this?<\/p>\n
Ransomware access control<\/b>\u00a0is a DataGuard<\/b> feature, which provides the user the ability to safeguard important data from ransomware. More info are provided in this article<\/a>\u00a0and in this Help Guide<\/a>.<\/p>\n In this particular case, where DataGuard is enabled for specific folders to safeguard against ransomware. As from this, svchost.exe (a legit Windows application) might try to access the file that is available in those folders, which is immediately blocked by DataGuard. By Default svchost.exe is not a trusted application by DataGuard.<\/p>\n You can find more details about this detection from the Elements Endpoint Protection Portal:<\/p>\n This means that\u00a0svchost.exe <\/b>has tried to modify\u00a0examplematerial.xlsx <\/b>which is saved on the users Desktop<\/b>\u00a0protected by DataGuard.<\/p>\n DataGuard works differently from our other engines, as it tries to be as paranoid as possible (even detecting Microsoft Windows files). This is because some malwares will inject into legitimate Microsoft files, which explains why DataGuard is more paranoid compared to other engines. DataGuard only allows trusted applications to modify protected files. By default svchost.exe is not a trusted application.\u00a0<\/p>\n\n
Target<\/b> C:\\Users\\Username\\Desktop\\My Documents\\examplematerial.xlsx<\/b>
Profile version xxxxxxxxx
Client timestamp Oct 30, 2020 4:51:35 AM
Transaction id 0000-xxxxxxxxx
\u00a0<\/div>\n