Evasion Technique - 3348100960

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Evasion Technique - 3348100960

L1 Bithead

“Behavior of hiding RWX code by modifying it to RX”

I've been seeing this alert that is considered high criticality and is blocking Windows updates.

 

Everything I can see says that this is benign.

XDR is saying that the Windows process is a non-whitelist CGO. I've verified that this is the legitimate Microsoft WerFault.exe

CharlieJohnstonNTS_0-1699971904273.png

 

There is no description of what is triggering this alert, there is no description of this evasion technique, and the causality chain is very little help.

CharlieJohnstonNTS_1-1699972124759.png

I've also verified that the behavior is caused when a user tries to update, or an automatic update starts.

Is anyone having a similar issue where XDR is blocking Windows updates?

 

1 accepted solution

Accepted Solutions

L1 Bithead

Started a support case and it was determined to be a false positive and will be fixed in the next content release (1190).

View solution in original post

1 REPLY 1

L1 Bithead

Started a support case and it was determined to be a false positive and will be fixed in the next content release (1190).

  • 1 accepted solution
  • 460 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!