All server ""PDM:Exploit.Win32.Generic""

[Nicodmx]

From yesterday i have many event about  "PDM:Exploit.Win32.Generic" from C:\\Windows\\System32\\wbem\\WmiPrvSE.exe in all server of my enterprise (36 servers)

this is a windows proccess and kaspersky dont show more information beacuse this is malicious in exploit prevention

Last databases update : 07/11/2023 11:21:00 GMT -4
KSC For Windows: 12.1.0.506

anyone known what it this?

i believe this is a false positive, but not have information about what it kaspersky detect

[Demiad]

Send the file for re-analysis through the service: https://opentip.kaspersky.com/

[Nicodmx]

All search engine have this executable trusted for windows

https://opentip.kaspersky.com/1D7B11C9DEDDAD4F77E5B7F01DDDDA04F3747E512E0AA23D39E4226854D26CA2/results

but the module exploit prevention detect malicious and event dont see why

[Demiad]

@Nicodmx,

1. Please collect traces while creating a detection event.
https://support.kaspersky.com/14364
2. Create a support request: https://support.kaspersky.com/b2b/
Attach trace files (from item 1) and System Watcher logs: https://support.kaspersky.com/15544