topic Java Deserialization exploit preventions are covered in which module of exploit protection in cortex xdr? in Cortex XDR Discussions

Java Deserialization exploit preventions are covered in which module of exploit protection in cortex xdr?

tejasp04 — Thu, 16 Dec 2021 06:34:13 GMT

Hello all,

Need information regarding Java Deserialization exploit protection in cortex XDR.

Java Deserialization exploit preventions are covered in which module of exploit protection in cortex xdr?

Thanks in advance.

Re: Java Deserialization exploit preventions are covered in which module of exploit protection in cortex xdr?

jcandelaria — Thu, 16 Dec 2021 07:10:18 GMT

If you referring about Log4J exploit. Below are the details.

https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-2021-44228/

https://www.paloaltonetworks.com/blog/security-operations/hunting-for-log4j-cve-20210-44228-log4shell-exploit-activity/

The exploit attempt will be blocked by the Java Deserialization Exploit protection module which is automatically activated when you enable Known Vulnerable Processes Protection in the Linux Exploit Security profile. We highly recommend making sure the Known Vulnerable Processes Protection module is set to block (which is the default configuration). Once the module is set to block (which is the default configuration) Cortex XDR agent will block this activity and raise a Suspicious Input Deserialization alert.

Re: Java Deserialization exploit preventions are covered in which module of exploit protection in cortex xdr?

tejasp04 — Thu, 16 Dec 2021 07:16:10 GMT

Thanks for reponse.