'Kernel Privilege Escalation' generated by XDR Agent detected on host xyz involving user xyz

AsifSid — Tue, 17 Nov 2020 14:15:28 GMT

Hi All

We are receiving large number of alerts in our cortex xdr console, The alert is as below, (hostname and user name I have kept as XYZ for privacy)

'Kernel Privilege Escalation' generated by XDR Agent detected on host XYZ involving user XYZ"

In all the alerts the process involved is "java."

I need to understand this alert and the steps to be followed next.

Please share you knowledge on this.

Thanks & Regards

Asif Siddiqui

Re: 'Kernel Privilege Escalation' generated by XDR Agent detected on host xyz involving user xyz

gjenkins — Thu, 03 Dec 2020 01:19:44 GMT

Hi AsifSid,

I'd recommend starting by gathering more information about the alert by viewing the Causality Chain, which details the activities involved in suspicious behavior. This can be accessed by right-clicking on an alert, hovering over "Investigate Causality Chain," and choosing a resulting option.

After determining whether the alert is a true- or false-positive, you can take your next steps:

If a true-positive, ensure that the activity was blocked by the Cortex XDR Agent and follow your company's incident response procedures further.
If a false-positive, the next step would be to tune Cortex XDR to allow this behavior type.

In general, creating rule exceptions is discussed here (Skip to 2:41 of the video.) However, given the information you've provided, you'll likely create a Java Deserialization exception as documented here.

topic Re: 'Kernel Privilege Escalation' generated by XDR Agent detected on host xyz involving user xyz in Cortex XDR Discussions

'Kernel Privilege Escalation' generated by XDR Agent detected on host xyz involving user xyz

Re: 'Kernel Privilege Escalation' generated by XDR Agent detected on host xyz involving user xyz