topic Re: XDR Masquerading Incident in Cortex XDR Discussions

XDR Masquerading Incident

CUppin — Thu, 24 Aug 2023 02:28:39 GMT

From few days getting the alerts under the "Masquerading" alert name. when we analyzed we observed there is a .exe file creation in the sysmon folder with the long string "C:\Sysmon\2BE609177094318EA49602B566942D95E6C81494161F8EC8A3AA6AE26FFCDD14F8F552F6EE998A9733C34F4AAF428DB9DB744FA7C1249F6E2874F1E2C4F621938B8269F64342DC2DF708853CEE37820C03BB3E66.exe"

Initiator CMD:

C:\Windows\system32\msiexec.exe /V

Initiator Path

C:\Sysmon\2BE609177094318EA49602B566942D95E6C81494161F8EC8A3AA6AE26FFCDD14F8F552F6EE998A9733C34F4AAF428DB9DB744FA7C1249F6E2874F1E2C4F621938B8269F64342DC2DF708853CEE37820C03BB3E66.exe

XDR is detecting under the behavioral threat .

Why exe files are creating under the "sysmon folder' with very long string.

Re: XDR Masquerading Incident

aspatil — Tue, 29 Aug 2023 14:01:45 GMT

Hello,

Can you please help us with the hash value of "C:\Sysmon\2BE609177094318EA49602B566942D95E6C81494161F8EC8A3AA6AE26FFCDD14F8F552F6EE998A9733C34F4AAF428DB9DB744FA7C1249F6E2874F1E2C4F621938B8269F64342DC2DF708853CEE37820C03BB3E66.exe"

What makes you think this is a XDR Application? Can you please check the App details and see if this app is signed by Palo Alto Networks?

Re: XDR Masquerading Incident

CUppin — Thu, 12 Oct 2023 09:47:55 GMT

Hi @aspatil

Hash of the File : ee998a9733c34f4aaf428db9db744fa7c1249f6e2874f1e2c4f621938b8269f6
Microsoft Signed "msiexec.exe" process

I'm not saying it is signed by cortex.

My question is
Why the Microsoft signed EXE's are getting renamed and getting saved in "C:\Sysmon\" folder ?

Re: XDR Masquerading Incident

eumbach — Wed, 18 Oct 2023 15:55:30 GMT

Do you have file deletion protection enabled in your SysMon config xml?