Letsdefend SOC335 - CVE-2024-49138 Exploitation Detected

Take ownership of the alert. Create case There is a malicious process named svohost.exe which is named close to svchost.exe . Svchost.exe (Service Host) is an essential Windows system process that loads and manages multiple background services (DLL-based) to save system resources and improve stability. Weird name for the process user EC2AMAZ-ILGVOIN\LetsDefend enough to spark doubt and take the alert seriously. Looking at the file hash, I decided to search for it on Virustotal. 50 out of 72 vend