'Kernel Privilege Escalation' generated by XDR Agent detected on host xyz involving user xyz

[AsifSid]

Hi All

We are receiving large number of alerts in our cortex xdr console, The alert is as below, (hostname and user name I have kept as XYZ for privacy)

'Kernel Privilege Escalation' generated by XDR Agent detected on host XYZ involving user XYZ"

In all the alerts the process involved is "java."

I need to understand this alert and the steps to be followed next.

Please share you knowledge on this.

Thanks & Regards

Asif Siddiqui

[gjenkins]

Hi AsifSid,

I'd recommend starting by gathering more information about the alert by viewing the Causality Chain, which details the activities involved in suspicious behavior. This can be accessed by right-clicking on an alert, hovering over "Investigate Causality Chain," and choosing a resulting option.

After determining whether the alert is a true- or false-positive, you can take your next steps:

• If a true-positive, ensure that the activity was blocked by the Cortex XDR Agent and follow your company's incident response procedures further.
• If a false-positive, the next step would be to tune Cortex XDR to allow this behavior type.

In general, creating rule exceptions is discussed here (Skip to 2:41 of the video.) However, given the information you've provided, you'll likely create a Java Deserialization exception as documented here.