The configuration of "Normal" and "Aggressive" protection modes for Reverse Shell Protection and Malicious Child Process Protection (C01) on Linux follows the general Cortex XDR logic of balancing detection sensitivity against system stability, though the specific technical implementation differs significantly from the Windows Anti-Ransomware module.

Comparison to Windows Ransomware Protection:

While the labels "Normal" and "Aggressive" are identical to those found in the Windows Ransomware Protection module, the underlying mechanism is not the same.

Windows Ransomware Protection: Uses a deception mechanism involving decoy files (honeypots). Aggressive mode increases sensitivity by exposing more applications and folders to these decoy files.
Linux Protection Modules: The Linux Reverse Shell and Malicious Child Process modules do not utilize decoy files or honeypots. Instead, they rely on behavioral rules, real-time process monitoring, and kernel-level interception.

Technical Differences in Protection Modes:

In the absence of specific Linux-module documentation, the operational differences are inferred from the general behavior of these settings within the platform:

Normal Mode (Default): This mode is optimized for production stability and minimizing false positives. It uses baseline behavioral thresholds and rule sets designed to minimize interference with legitimate applications.
Aggressive Mode: This mode increases the security posture by enabling more sensitive detection parameters. While it provides broader coverage against evasive threats, it also carries a higher risk of false positives and may have a greater impact on user experience.

The specific rule thresholds or sensitivity adjustments that differentiate Normal from Aggressive mode for these Linux-specific modules are not publicly documented.

topic Re: Protection Mode for Linux Modules in Cortex XDR Discussions

Protection Mode for Linux Modules

Re: Protection Mode for Linux Modules

Comparison to Windows Ransomware Protection:

Technical Differences in Protection Modes: