XDR Masquerading Incident

[CUppin]

From few days getting the alerts under the "Masquerading" alert name. when we analyzed we observed there is a .exe file creation in the sysmon folder with the long string "C:\Sysmon\2BE609177094318EA49602B566942D95E6C81494161F8EC8A3AA6AE26FFCDD14F8F552F6EE998A9733C34F4AAF428DB9DB744FA7C1249F6E2874F1E2C4F621938B8269F64342DC2DF708853CEE37820C03BB3E66.exe"

Initiator CMD:

C:\Windows\system32\msiexec.exe /V

Initiator Path

C:\Sysmon\2BE609177094318EA49602B566942D95E6C81494161F8EC8A3AA6AE26FFCDD14F8F552F6EE998A9733C34F4AAF428DB9DB744FA7C1249F6E2874F1E2C4F621938B8269F64342DC2DF708853CEE37820C03BB3E66.exe

XDR is detecting under the behavioral threat .

Why exe files are creating under the "sysmon folder' with very long string.

Cortex XDR 

[aspatil]

Hello,

Can you please help us with the hash value of "C:\Sysmon\2BE609177094318EA49602B566942D95E6C81494161F8EC8A3AA6AE26FFCDD14F8F552F6EE998A9733C34F4AAF428DB9DB744FA7C1249F6E2874F1E2C4F621938B8269F64342DC2DF708853CEE37820C03BB3E66.exe"

What makes you think this is a XDR Application? Can you please check the App details and see if this app is signed by Palo Alto Networks?

[CUppin]

Hi @aspatil 

Hash of the File : ee998a9733c34f4aaf428db9db744fa7c1249f6e2874f1e2c4f621938b8269f6
Microsoft Signed "msiexec.exe" process

I'm not saying it is signed by cortex.

My question is
Why the Microsoft signed EXE's are getting renamed and getting saved in "C:\Sysmon\" folder ?

[eumbach]

Do you have file deletion protection enabled in your SysMon config xml?