Memory Corruption Exploit Alerts - Incidents

KRisselada — Mon, 11 Oct 2021 22:37:41 GMT

Hello LiveCommunity, I wondered if any others are seeing a very high number of recently created (in the last few hours) "Memory Corruption Exploit" alerts in Cortex XDR?

Beginning around 1015 Pacific this morning (11 Oct) thru as recent at 1518 Pacific, 11 Oct there has been numerous alerts fired across many different Workstations

Seeing many different Initiator Paths such as:
C:\Windows\System32\spoolsv.exe

C:\Program Files\Google\Chrome\Application\chrome.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Program Files (x86)\Internet Explorer\iexplore.exe

I thought perhaps it was a Content update, but does not look like there has been a new content update since sometime last week.

Re: Memory Corruption Exploit Alerts - Incidents

tvilas — Tue, 12 Oct 2021 21:57:49 GMT

Hello,

In this case, I would recommend opening a support case if you have concerns that this being a false positive. The support team can assist you to further investigate what behavior changed, in the meantime, you have the option to suppress these alerts.

topic Memory Corruption Exploit Alerts - Incidents in Cortex XDR Discussions

Memory Corruption Exploit Alerts - Incidents

Re: Memory Corruption Exploit Alerts - Incidents