A question from the Alert Tuning Operations Webinar: Signing level in a child process

rtsedaka — Thu, 23 Jun 2022 09:05:21 GMT

We have a mac-device on which even a reinstalled chrome creates child processes (Google Chrome Helper) that are apparently below the signing level of the parent process. Their signatures seem to be valid. Seems like whitelisting the hash of the initiator is not the best idea. What would be the best process if a child's process is blocked due to the signing level of the parent?

Re: A question from the Alert Tuning Operations Webinar: Signing level in a child process

fmoixsante — Thu, 23 Jun 2022 09:08:44 GMT

Hi @rtsedaka,

Is Google Chrome Helper being blocked by XDR? if yes, which alert type? Local Analysis? Wildfire? Suspicious Process Creation?

topic Re: A question from the Alert Tuning Operations Webinar: Signing level in a child process in Cortex XDR Discussions

A question from the Alert Tuning Operations Webinar: Signing level in a child process

Re: A question from the Alert Tuning Operations Webinar: Signing level in a child process