topic Re: Cortex XDR Agent Tamper Protection Notification in Cortex XDR Discussions

Cortex XDR Agent Tamper Protection Notification

RahulPrajapati — Tue, 25 Jan 2022 04:46:51 GMT

Hi everyone,

Can we get the notification on Cortex XDR Management console, if any user is trying to disable the XDR Agent protection and services ?

Regards

Re: Cortex XDR Agent Tamper Protection Notification

bbarmanroy — Tue, 25 Jan 2022 06:16:29 GMT

Hi @RahulPrajapati users cannot uninstall or disable any functionalities without the Agent password defined globally or in Agent settings profile applied to a host. If you have a PoC to demonstrate the bypass, we can definitely take a deep dive at it to fix the issue.

In short, you won't get a notification for such behavior at this point in time.

Re: Cortex XDR Agent Tamper Protection Notification

RahulPrajapati — Tue, 25 Jan 2022 08:50:43 GMT

Hi @bbarmanroy ,

Some local engineers had the uninstall password so we have changed it. I can see the Agent service stop logs from Agent Audit logs. But many of them can possibly means that system got shutdown and so Agent service got stop. But if any user tries to disable the agent service using cytool command. Can we know that information from the Agent audit logs?

Regards

Re: Cortex XDR Agent Tamper Protection Notification

bbarmanroy — Wed, 26 Jan 2022 01:40:56 GMT

Hi @RahulPrajapati you are correct - a shutdown will stop Agent services.

If a user is successfully able to stop one or more XDR agent services, that will be listed as an event in the Agent Audit logs. Unsuccessful attempts won't be listed.

Re: Cortex XDR Agent Tamper Protection Notification

Cyber1985 — Mon, 25 Jul 2022 17:02:34 GMT

There must be a way :). Since the agent is watching every process, there must be a way to throw an alert, when something irregular happens to the Services??

Rob