ossec-agent.exe and Palo Alto Behavioral Threat Incident

[Lee Seeman]

Palo Alto Cortex XDR is detecting and blocking 'ossec-agent.exe' and its chain of processes as a Behavioral Threat for the following MITRE AT&CK techniques:

1. T1555 - Credentials from Password Stores 
2. OS Credential Dumping: Security Account Manager  
3. T1555 - Credentials from Password Stores 

Unfortunately Cortex still blocks and alerts even if path is added to allow list or signer is added in behavioral threat analysis profile. This is due to its hitting rule-sets; Palo Alto engineering is analyzing and add a support exception...

My question is, can someone confirm this is a result of the Wazuh Vulnerability Detection module being enabled?

[Lee Seeman]

[Lee Seeman]

Key Artifacts that were in the process chain:

net.exe

cmd.exe

net1.exe

conhost.exe

On Friday, October 16, 2020 at 9:54:32 AM UTC-4 Lee Seeman wrote:

[Lee Seeman]

This is a false-positive Mimikatz Behavioral Threat incident with PAN Cortex XDR. PAN support engineering is working on a content update for it and exclusion.