Has anyone seen this ADSync tampering alert on Defender 365 before?

Recently we have had an alert popping up on Microsoft 365 Defender, classifying our AAD Sync server (on Azure VM) as "Potential ADSync tampering". Not quite sure if the below is a false positive.

[Screenshot of the alerts](https://imgur.com/J0xMdz8)

[Alert details](https://imgur.com/f9E71Pr)

I'm not very advanced at cybersecurity, but is it possible to modify a complied executables as shown in the first screenshot? These executables belong to Microsoft AAD Connect as far as I know.

alert cybersecurity defender tampering