'Hijacked DLL Injection' alerts

[Balaraju]

Greetings ,

The single most common and repeating alert which we are getting is like below :

'' 173 'Hijacked DLL Injection' alerts detected by XDR Agent on 24 hosts ''

Explanation is 'DLL attempted to load from blacklisted location' .So 2 questions here

What we are supposed to do here ? What is the investigation path we should follow ? What above alert means ?Should we be worried ?

I assume I have read that this protection module  is among those modules which cannot be configured or modified ?

Overall looking to understand these type of alerts though they appear as ' Detected(Reported)' and Not Prevented(Blocked) .

Thanks in advance for response 

[bbarmanroy]

Hi @Balaraju You'll need to take a look at the alert itself, and investigate through the Causality Chain to identify the DLL that is being tried to load. You will see a process that is trying to load the DLL for each alert.

Next, look at your Exploit profile applied to the endpoint/set of endpoints. You probably have a list of DLL's blocked in the Profile configuration.

The configuration of that setting determines if the attack is disabled, reported or prevented.

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/endpo...

[Balaraju]

Thanks for your response . This is helpful 

[bbarmanroy]

Great, happy to advise you on the right track! 

[Balaraju]

The process in almost all cases is 'rundll32.exe' , though the Exploit profile is set as Default(Block) , all the alerts show up as Detected(Reported) . No block list has been configured either in the Exploit profile  .