Incidents
XDR-4817HighContainedTrue Positive90%
Credential dumping attempt – lsass access blocked by XDR agent
Affected: HP-FS-01 · svc_backupCortex XDRUpdated 04:24 PT · Owner AI SOC
AI summary
Process comsvcs.dll MiniDump against lsass.exe blocked by Credential Gathering Protection. Process killed automatically under policy rule CP-07.
Verdict
True Positive90%
Customer-approved model · AWS GovCloud (us-gov-west-1) · inside Halcyon's account. Time to verdict 47s.