Datto EDR - Mass Detection on Windows Behavior – 2026-08-27 

Summary 

Between 2026-08-27 08:00 UTC and 2026-08-27 16:00 UTC, Datto EDR customers experienced an elevated volume of detections generated by the Possible Shim Database Persistence via sdbinst.exe detection rule. The increase in alerts created additional operational overhead for customers and analysts reviewing alerts. No service outage occurred, and endpoint protection functionality remained operational throughout the event. The issue was resolved after the detection rule was updated to account for a newly observed legitimate Windows operating system behavior.  

Root Cause 

A legitimate Microsoft Windows behavior involving sdbinst.exe and the file path C:\Windows\appcompat\cloudsdb\apppatch.sdb was not covered by the existing exclusions within a Datto EDR detection rule. A change in Microsoft's behavior matched the criteria of the rule Possible Shim Database Persistence via sdbinst.exe, resulting in a higher-than-expected volume of detections. The rule logic was updated to properly account for the newly observed behavior and eliminate the unintended detections.  

Incident Timeline 

• Identified: 2026-08-27 08:00 UTC (customer reports and alert volume increase identified)  

• Public Notification: 2026-08-27 11:00 UTC (incident escalated to Product and Detection Engineering teams and communications initiated)  

• Resolved: 2026-08-27 16:00 UTC (updated rule deployed and alert volume returned to expected levels)  

Preventative Measures 

To reduce the likelihood and impact of similar incidents in the future, we are implementing the following improvements: 

Enhancements to Monitoring and Alerting 

• Implement monitoring and baselining for individual detection rules to identify abnormal spikes in alert volume more rapidly. 

• Develop internal metrics that provide visibility into detection trends and anomalous rule behavior before large-scale customer impact occurs.  

Enhancements to Incident Management and Response 

• Improve escalation workflows for significant detection-volume increases to ensure appropriate engineering resources are engaged as quickly as possible. 

• Continue refining response procedures for detection-rule tuning and validation when unexpected platform or operating system behavior changes are observed.  

Detection Content Improvements 

• Enhance detection engineering review processes to account for evolving operating system behaviors and newly introduced legitimate execution patterns. 

• Expand validation and exclusion testing for detection rules where operating system updates may introduce behavior changes that resemble suspicious activity.  

Customer Impact 

• Product Affected: Datto EDR 

• Impact Type: Increased detection volume / mass alerts 

• Service Availability: No outage 

• Security Protection Status: Protection remained active and operational 

• Customer Impact: Customers experienced increased alert volume requiring additional review and operational effort.  

This incident has been fully resolved, and Datto EDR continues to operate normally.