Smoke test: is this alert real?

Rule fired on a VDI host after the May update. Parent process is the updater. What did others see?

We have seen this rule fire on VDI images after the May update; it is the updater service and is benign. Vendor employee, disclosed.

We have seen this rule fire on VDI images after the May update; it is the updater service and is benign. Vendor employee, disclosed.