XDR Agent - retrieve more information events

[tlmarques]

Hi,

I have a question. I'm seeing XDR events with "Memory Corruption Exploit" generated by the XDR Agent... Cortex XDR  

I know this typically happens when users open a DOCX file with macros. My question is: Is there a way to collect information related to the macro?

I'm asking because, in the artifacts, I only see the initiator "WINWORD.EXE", but not the actual file.

My goal is to capture this information or understand how I can retrieve it to enrich Cortex XSOAR  and improve analysis results

[aspatil]

Hello @tlmarques ,

Regarding the Memory Corruption Exploit, you will need to contact TAC. They will collect the necessary logs and provide a Support Exception based on the FVHash. If you are seeing these alerts frequently, TAC can also help with the Root Cause Analysis (RCA), which you can leverage in XSOAR.

Also check if you have  "Qi An Xin" (QAX) as we have compatibility issues.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.