RootCauseunvalidated
Triggered process: powershell_ise.exe. Tension: The EDR would see "normal" activities as actions related to the AD Connect service, running non-interactively. Outcome: The alert and block action is valid from a certain perspective.
1b246da0-afc9-4a46-97fe-bb2affe7ba57
Triggered process: powershell_ise.exe. Tension: The EDR would see "normal" activities as actions related to the AD Connect service, running non-interactively. Outcome: The alert and block action is valid from a certain perspective.