https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-agent-removal/m-p/600504#M7326 <P>Hi all,</P> <P>In one of our endpoints XDR agent triggerd an alert named '</P> <DIV class="cell-value"><SPAN class="cell-value-text ng-star-inserted" title="Suspicious file modification detected ">Suspicious file modification detected </SPAN>'&nbsp; cmd is 'C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}'&nbsp; after this XDR service cyserver was stopped , now status is disconnected, we don't have data to analyze the issue. what can i do </DIV> Mon, 14 Oct 2024 10:32:08 GMT Natig.Rahimov 2024-10-14T10:32:08Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-agent-removal/m-p/600504#M7326 <P>Hi all,</P> <P>In one of our endpoints XDR agent triggerd an alert named '</P> <DIV class="cell-value"><SPAN class="cell-value-text ng-star-inserted" title="Suspicious file modification detected ">Suspicious file modification detected </SPAN>'&nbsp; cmd is 'C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}'&nbsp; after this XDR service cyserver was stopped , now status is disconnected, we don't have data to analyze the issue. what can i do </DIV> Mon, 14 Oct 2024 10:32:08 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-agent-removal/m-p/600504#M7326 Natig.Rahimov 2024-10-14T10:32:08Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-agent-removal/m-p/600523#M7330 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/307353">@Natig.Rahimov</a>&nbsp;</P> <P>&nbsp;</P> <P>Thanks for reaching out on LiveCommunity!</P> <P>Please open a TAC support case to investigate the issue.</P> Mon, 14 Oct 2024 15:19:31 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-xdr-agent-removal/m-p/600523#M7330 nsinghvirk 2024-10-14T15:19:31Z