Tampering attempt of the XDR agent

[yuyangab]

Hello, everyone

I found an event called "Tampering attempt of the XDR agent" that was blocked by XDR.
For a description of this event, I tried to see if there was one in the Cortex XDR Analytics Alert Reference, but I couldn't find it.

Details of incidents have been uploaded to the attachment.

Is this event a registry tampering event initiated by XDR? Why does XDR perform registry modification operations?

[dbahuguna]

Hi @yuyangab,

Thank you for reaching out to Live Community. Please allow me to address your questions.

1. Source of alert is XDR Agent and not XDR Analytics here and the alert is triggered by Behavioral Threat Protection. You can refer the screenshot shared as mentioned the source is XDR Agent and module is BTP.
2. For more information about Anti Tampering Protection and Behavioral Threat Protection you can refer the provided link: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Add-a-N...
3. Please note that this is a public discussion board and as such we do not advise you to share screenshots from your XDR environment or alert files. My suggestion would be to refer to your Customer Success team or TAC by opening a ticket through our support portal

Regards

[yuyangab]

Thank you for your reply.

If it is malicious behavior caused by malware, the subject of the alert should be the malware, not the XDR Agent.

For this alert "Tampering attempt of the XDR agent", I wonder if the XDR agent is trying to modify the registry?

[dbahuguna]

Hi @yuyangab ,

In order to investigate if XDR Agent is trying to modify the registry or not, my suggestion would be to refer to your Customer Success team or TAC by opening a ticket through our support portal

Regards