topic Re: Hidden User Created | CtxPkmService in Endpoint Security

Hidden User Created | CtxPkmService

ventaran — Mon, 15 Jul 2024 11:48:09 GMT

Good morning,

Anyone else who uses Citrix and Secure Endpoint seeing alerts for Hidden User Created with the value CtxPkmService being added into \MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList ?

This looks a FP to me. Started happening past 24 hours.
Thank you for your time and help.

Re: Hidden User Created | CtxPkmService

flindemann — Mon, 15 Jul 2024 12:03:41 GMT

Hi there!

We have had the same Issue last Thursday. It appears that the alert is related to a specific Citrix version update to the Workspace Client. We consider it a false positive, especially since no hidden user has been created permanently.

Regards, Frank

Re: Hidden User Created | CtxPkmService

Matthew Franks — Mon, 15 Jul 2024 12:20:17 GMT

Thank you for bringing this False Positive to our attention. We also had a TAC case filed on this and the issue has since been resolved. If you see the issue occur again, please open a TAC case so we can get it addressed quickly.

Thanks,

Matt

Re: Hidden User Created | CtxPkmService

TaylorOfTheCave — Mon, 15 Jul 2024 12:53:54 GMT

This is still occurring Matt.

We're seeing these 'Hidden User Created' detections for the Citrix 'CtxPkmService' alerts from AMP as recently as 15 minutes ago.

Re: Hidden User Created | CtxPkmService

Matthew Franks — Mon, 15 Jul 2024 13:16:30 GMT

Interesting. I'll reach out to the developers and see what we can do. Do you have a TAC case open I can reference?

Thanks,

-Matt

Re: Hidden User Created | CtxPkmService

Matthew Franks — Mon, 15 Jul 2024 13:19:18 GMT

I'd suggest trying to update your signatures considering that is how it was resolved.

In case that doesn't work, what connector version are you on?

-Matt

Re: Hidden User Created | CtxPkmService

TaylorOfTheCave — Mon, 15 Jul 2024 14:04:48 GMT

I do see all of the clients who reported the FP also did Signature/Policy/Component updates within a few minutes of the detection so my expectation is that these clients had been offline since before the update was pushed via policy and they just did the scan/detection before they did the signature update.

I've updated our TAC case to reference that it's likely due to an order-of-operations issue with the definition update and the scan.

Re: Hidden User Created | CtxPkmService

jplopper — Mon, 15 Jul 2024 15:36:04 GMT

We had a similar issue that started on July 9 and continued to July 12. Was correlated with a Citrix Receiver update.