Process injection into lsass

dexigaj330 — Thu, 06 Nov 2025 07:36:19 GMT

We received an alert indicating creation of a remote thread in the lsass process by the Cortex XDR agent (cyserver.exe).

I noticed that during the same time period, there were a few other processes that got injected by the agent (e.g. explorer, svchost, wmiprvse, and other Palo executables). I am aware that it might inject a monitoring stub to prevent other processes from dumping lsass memory but since most of XDR's detection mechanisms are performed in kernel mode and that's the first time we've seen it I figured I'd ask.

Re: Process injection into lsass

delia598guzman — Thu, 13 Nov 2025 06:20:00 GMT

@dexigaj330 wrote:

We received an alert indicating creation of a remote thread in the lsass process by the Cortex XDR agent (cyserver.exe).

I noticed that during the same time period, there were a few other processes that got injected by the agent (e.g. explorer, svchost, wmiprvse, and other Palo executables). I am aware that it might inject a monitoring stub to prevent other processes from dumping lsass memory but since most of XDR's detection mechanisms are performed in kernel mode and that's the first time we've seen it I figured I'd ask.

Hello @dexigaj330,
This behavior is expected—Cortex XDR may inject monitoring stubs into processes like lsass, explorer, and svchost to prevent credential dumping and enhance visibility. While most detections occur in kernel mode, user-mode injections help enforce protections. If it's your first time seeing this, it's likely tied to a recent update or policy change.

Best Regards,
Delia Guzman

topic Process injection into lsass in Cortex XDR Discussions

Process injection into lsass

Re: Process injection into lsass