Alert with auditd64.bin

This sounds like someone running the cfexecute command, which is then doing that net group command. Is that trouble? Maybe yes, maybe no. If somehow it's the work of someone doing it for good, it's not. If instead it's work no one there recognizes, then I'd be worried...and all the more given your earlier troubles.

Something you've not clarified is what update of cf2016 you have in place. If it's not the latest (update 17 from March 2021), there are vulns that may have been leveraged. Even if applied, there have been no further updates since then, as 2021 was the end of its 5-year life (cf2018 support/updates end in July 2023, and cf2021 in Nov 2024, all 5 years after they came out).

Then there's the question of what Java version cf is running. It could be quite old, given that cf2016 came out originally 6 yrs ago. There are many resources on updating that, from Adobe, myself, and others. Or I can help you get both the cf and Java updates in place in less than a half hour (perhaps less than 15 mins), via remote screenshare consulting.

Granted, when making such a change, it's best to do it in a test environment, to do some testing of your app on the new version/s, but given your troubles/concerns you may not have that luxury. 

Still another thing to consider is better securing your cf. By default, cf runs as the local system user, which is what would allow that net command above to work. That can be changed, in perhaps just a few mins, with a new user that's given far less privileges--just enough to run cf and no more. There's a lockdown guide for cf explaining dozens of things, but that one is key (along with the updates). For those on cf2018, there's a new autolockdown tool which does EVERYTHING in the lockdown guide, for better or worse. 

I know you said in your previous note you were going to cf2021. Doing that MIGHT address SOME of the issues you're facing, but even in that move much of what I say above will still apply. So again, if you want things implemented more completely, with guided assistance, you need not go it alone, nor await back and forth here. We could meet even today. More at carehart.org/consulting. Dave may also be available for consulting. 

Dear Dave,

Many thans to you for the helpful replies, we have isolated the server as suggested. We have additionaly found that 2 windows user accounts have been created (1 with local admin rights) on this server. We have a strategy meeting later on, I will keep you informed.

BR,

Eric