LSA Protection and antimalware DLL loading

maxime_ch — Wed, 08 Jan 2025 14:36:31 GMT

We currently have deployed LSA Protection and code integrity in Windows 11 (build 24H2).

Cortex XDR agent 8.6.0 is installed. When trying to load a DLL from another security tool (Ivanti Device and Application Control), Code Integrity is blocking the action with the following error:

Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Palo Alto Networks\Traps\cyserver.exe) attempted to load \Device\HarddiskVolume3\Windows\System32\sxwmon64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

Antimalware signing requirements are documented here, and the following statement may be related : Protecting anti-malware services - Win32 apps | Microsoft Learn

The user-mode service that needs to be launched as protected must be signed with valid certificates. The service EXE must be page hash signed, and any non-Windows DLLs that get loaded into the service must be also signed with the same certificates. The hash of these certificates must be added into the resource file, which will be linked into the ELAM driver.

Any recommendation?

Thank you

Re: LSA Protection and antimalware DLL loading

jmazzeo — Wed, 15 Jan 2025 17:50:19 GMT

Hi @maxime_ch, thanks for reaching us using the Live Community.

That's an expected behavior in the XDR agent. Can you create an exception for this case in the LSA Protection managing tool?

topic LSA Protection and antimalware DLL loading in Cortex XDR Discussions

LSA Protection and antimalware DLL loading

Re: LSA Protection and antimalware DLL loading