topic Re: Cortex Blocks system services in Cortex XDR Discussions

Cortex Blocks system services

PierazzoD — Thu, 12 May 2022 11:34:40 GMT

Hello everyone,

the problem started a day ago, when Cortex XDR started to trigger the behavioral rule "other.malware_gen_task.105" on the service

"System", when executing the child processes "smss.exe", "registry" and "memorycompression". It started without any previous changing.

Have you got some information about this topic?

Thanks

Re: Cortex Blocks system services

eluis — Thu, 12 May 2022 13:27:53 GMT

Hi @PierazzoD

in this case, please feel free to open a TAC support case and be ready to provide support files. Agent releases and content releases... the more information you can give our support team, the better

KR,

Luis

Re: Cortex Blocks system services

WSeldenIII — Thu, 12 May 2022 13:48:54 GMT

Hi @PierazzoD,

The alert for the BTP rule mentioned above has been confirmed to be a false positive, and a fix has been implemented in content update version 510-90618. This content version was release on May 11, 2022 around 10:00 AM EST. Please ensure that you are enable configured to receive the latest content updates by reviewing the Agent Setting Profile - Content Configuration setting applied to your endpoints. If you experience any additional operational impact, then you may raise a support case to determine next steps.