Process injection into lsass

[dexigaj330]

We received an alert indicating creation of a remote thread in the lsass process by the Cortex XDR agent (cyserver.exe).

I noticed that during the same time period, there were a few other processes that got injected by the agent (e.g. explorer, svchost, wmiprvse, and other Palo executables). I am aware that it might inject a monitoring stub to prevent other processes from dumping lsass memory but since most of XDR's detection mechanisms are performed in kernel mode and that's the first time we've seen it I figured I'd ask. 

[delia598guzman]

---

@dexigaj330 wrote:

We received an alert indicating creation of a remote thread in the lsass process by the Cortex XDR agent (cyserver.exe).

I noticed that during the same time period, there were a few other processes that got injected by the agent (e.g. explorer, svchost, wmiprvse, and other Palo executables). I am aware that it might inject a monitoring stub to prevent other processes from dumping lsass memory but since most of XDR's detection mechanisms are performed in kernel mode and that's the first time we've seen it I figured I'd ask. 

---

Hello @dexigaj330,
This behavior is expected—Cortex XDR may inject monitoring stubs into processes like lsass, explorer, and svchost to prevent credential dumping and enhance visibility. While most detections occur in kernel mode, user-mode injections help enforce protections. If it's your first time seeing this, it's likely tied to a recent update or policy change.

Best Regards,
Delia Guzman