MS Defender False alert? - Office Serviceability Manager

Hi Guys. I got 2 alerts for "Ransomware behaviour detected in the file system" I have about 2,000 endpoints, but only got 2 alerts.

It appears to me to be a false positive, but wanted to see if anyone else here has received an alert like this today.

Behaviour:

schtasks.exe /Create /tn "Microsoft\\Office\\Office Serviceability Manager" /XML "C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeSvcMgrSchedule\_90M.xml"

schtasks.exe /change /tn "Microsoft\\Office\\Office Serviceability Manager" /enable



**SrTasks.exe**

ExecuteScheduledSPPCreation

\--> **An attempt to delete volume shadow copies was made**

alert cybersecurity defender manager office