SentinelOne detected \Config.Msi\4e6142cc.rbf as Ransomware in Windows Server

An .rbf file in Config.Msi can be consistent with Windows Installer rollback activity: Microsoft documents that installation creates rollback information and copies of files needed to reverse changes. However, that context does not establish that this particular file or SupportAssist installation is safe. An msiexec parent process and SYSTEM execution are not sufficient to dismiss a ransomware alert. Preserve the detection, file hash, installer source, process tree and installation timestamps rather than repeatedly deleting the file and losing evidence. Ask your security team to inspect the User-Defined Blocklist rule that actually triggered, and submit the relevant sample or hash privately through your security vendor's review process. Verify the installer against the official vendor package before rerunning it. Keep containment and protection in place until the investigation is complete. If there are signs of broader compromise, follow your incident-response process rather than adding an exclusion.