A new incident in Cortex XSIAM contains WildFire malware and Behavioral Threat Protection (BTP) alerts about an unsigned process attempting to dump the memory of lsass.exe . Which initial verdict applies to this incident?
In security operations, a True Positive occurs when the security platform correctly identifies a malicious activity or file. This specific scenario contains multiple high-fidelity indicators that confirm the malicious nature of the event:
WildFire Malware Alert: WildFire is Palo Alto Networks' cloud-based sandboxing service. A WildFire alert means the file hash has already been analyzed and confirmed as malicious.
BTP (Behavioral Threat Protection): This module in the Cortex agent identifies malicious actions rather than just file signatures. "Dumping the memory of lsass.exe" is a classic technique (often associated with tools like Mimikatz) used by attackers to steal cleartext passwords or NTLM hashes from memory.
Unsigned Process: Legitimate system tools are typically digitally signed by reputable vendors (like Microsoft). An unsigned process attempting to access a critical system process like LSASS (Local Security Authority Subsystem Service) is a massive red flag.
Because the tool alerted on a real threat that was indeed malicious, the verdict is a True Positive .
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit