topic XDR Agent - retrieve more information events in Cortex XDR Discussions

XDR Agent - retrieve more information events

tlmarques — Thu, 13 Feb 2025 18:27:09 GMT

Hi,

I have a question. I'm seeing XDR events with "Memory Corruption Exploit" generated by the XDR Agent...

I know this typically happens when users open a DOCX file with macros. My question is: Is there a way to collect information related to the macro?

I'm asking because, in the artifacts, I only see the initiator "WINWORD.EXE", but not the actual file.

My goal is to capture this information or understand how I can retrieve it to enrich and improve analysis results

Re: XDR Agent - retrieve more information events

aspatil — Mon, 17 Feb 2025 10:08:21 GMT

Hello @tlmarques ,

Regarding the Memory Corruption Exploit, you will need to contact TAC. They will collect the necessary logs and provide a Support Exception based on the FVHash. If you are seeing these alerts frequently, TAC can also help with the Root Cause Analysis (RCA), which you can leverage in XSOAR.

Also check if you have "Qi An Xin" (QAX) as we have compatibility issues.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.