Does sophos or is it possible to have sophos alert/generate a log when a process or application has been elevated? The scenario we have is, we have an application that has to run with admin privileges. The application has been saved to run with these privileges. So we want to alert or a log to be created if any other process or application has been elevated with saved credentials from the credential manager. Does sophos have this ability?
Hi Erik,
Thanks for reaching out to the Sophos Community Forum.
Intercept X includes PrivGuard, which will block an application trying to gain elevated permission rights.
If this may not fit your needs, I suggest taking a look at the Sophos Schema to see if any of the table Sophos XDR queries for, will contain the information you're looking for.
- Sophos Schema
You can also try posting a request for this type of Live Discover/Data Lake query to be created on the Live Discover and Response Query Forum
Hi Erik,
Thanks for reaching out to the Sophos Community Forum.
Intercept X includes PrivGuard, which will block an application trying to gain elevated permission rights.
If this may not fit your needs, I suggest taking a look at the Sophos Schema to see if any of the table Sophos XDR queries for, will contain the information you're looking for.
- Sophos Schema
You can also try posting a request for this type of Live Discover/Data Lake query to be created on the Live Discover and Response Query Forum
