'Hijacked DLL Injection' alerts

[Balaraju]

Greetings ,

The single most common and repeating alert which we are getting is like below :

'' 173 'Hijacked DLL Injection' alerts detected by XDR Agent on 24 hosts ''

Explanation is 'DLL attempted to load from blacklisted location' .So 2 questions here

What we are supposed to do here ? What is the investigation path we should follow ? What above alert means ?Should we be worried ?

I assume I have read that this protection module  is among those modules which cannot be configured or modified ?

Overall looking to understand these type of alerts though they appear as ' Detected(Reported)' and Not Prevented(Blocked) .

Thanks in advance for response 

[bbarmanroy]

Hi @Balaraju You'll need to take a look at the alert itself, and investigate through the Causality Chain to identify the DLL that is being tried to load. You will see a process that is trying to load the DLL for each alert.

Next, look at your Exploit profile applied to the endpoint/set of endpoints. You probably have a list of DLL's blocked in the Profile configuration.

The configuration of that setting determines if the attack is disabled, reported or prevented.

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/endpo...

[Balaraju]

Thanks for your response . This is helpful 

[bbarmanroy]

Great, happy to advise you on the right track! 

[Balaraju]

The process in almost all cases is 'rundll32.exe' , though the Exploit profile is set as Default(Block) , all the alerts show up as Detected(Reported) . No block list has been configured either in the Exploit profile  .

[eluis]

Hi Balaraju, 

apart from following the useful recomendations given by Bbarmanroy, and check if the DLLs on those alerts are in block lists or allowed, just reported but not blocked, etc.

The SOC/Security analysts need to know what are this dlls used for, are they legit windows ? something coming from a 3rd party or custom app you have installed ? 

XDR can identify the dlls that are signed by microsoft and figure out or determine that they are benign, even though we do not know and control all dlls available out there from 3rd parties, custom created by individuals.... this is part of the analyst job. And once identified malicious or benign you guys can add a trusted signer or allow hash..... 
XDR can also spot the malicious ones even they are unknown by their behavior or even based on ML, and block (depending on your settings) and alert you. After further analysis from your security guys you can decide if you want to continue blocking or allowing, lets say that this is part of the human intelligence we need to put on our daily security analysis. 

Hope this helps also

KR, 

Luis