Why would a process be labeled '<Unknown: nnnn>' by CSA?

moore_j58 · ‎10-07-2008

Recently, a few Windows XP clients have been experiencing a very annoying behavior. A whole raft of processes are showing up in the logs as '<Unknown: [pid]>' and user query responses about actions performed on or by these processes do not get associated with anything else done later on the box, even if the user is doing exactly the same thing.

What would cause a process to be labelled 'unknown'? Is this a misconfiguration in one of my rule modules or a bug?

tsteger1 · ‎10-07-2008

I would look for an autoupdate or other automatic process on the PCs in question.

We had some similar messages when AutoCAD tried to check for licenses and had to create a kernel only exception for it.

Tom

moore_j58 · ‎10-09-2008

Tom,

Automatic updates aplenty. We run WSUS. In addition Trend Micro, Firefox, Abobe Acrobat, and Sun's JRE all run scheduled automatic updates on our clients from time to time.

Help me out with the 'kernel only' exception. How do you build this?

Jim Moore

tsteger1 · ‎10-09-2008

Hi Jim,

Our machines run all of those too (except Firefox) but they don't cause the alerts in CSA 5.2.

Below is a link to a Cisco Security Agent Kernel-only Protection Configuration Example.

It's for version 4.5 though so may be dated.

What version are you running?

http://tools.cisco.com/search/display?url=http%3A%2F%2Fwww.cisco.com%2Fen%2FUS%2Fproducts%2Fsw%2Fsecursw%2Fps5057%2Fproducts_configuration_example09186a00805f0c18.shtml&pos=1&strqueryid=3&websessionid=1M8DgQUS9khEB4UKt3vRylv

Tom

moore_j58 · ‎10-10-2008

Tom,

We run CSA 5.2. The rule that gets triggered is 834 in the stock Base Application Permissions - Medium Security rule module. The rule queries user about a process writing to memory owned by another process. The applications that trip this rule in our environment include Firefox, Word, Outlook, Explorer and cmd.exe, always against an unknwown process. Known processes are typically logged with the path to the file holding the executable code being run by the process. So, does this mean that these applications generate dynamic code in system memory and execute it as a separate process? Or, does CSA give up when trying to identify the filesystem path of certain kinds of code?

I think I need an exception to rule 834, but I can't see how to define the target applications.