Hidden User Created | CtxPkmService

[ventaran]

Good morning,

Anyone else who uses Citrix and Secure Endpoint seeing alerts for Hidden User Created with the value CtxPkmService being added into \MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList ?

This looks a FP to me. Started happening past 24 hours.
Thank you for your time and help.

[flindemann · Accepted solution]

Hi there!

We have had the same Issue last Thursday. It appears that the alert is related to a specific Citrix version update to the Workspace Client. We consider it a false positive, especially since no hidden user has been created permanently.

Regards, Frank

[Matthew Franks]

Thank you for bringing this False Positive to our attention. We also had a TAC case filed on this and the issue has since been resolved. If you see the issue occur again, please open a TAC case so we can get it addressed quickly.

Thanks,

Matt

[TaylorOfTheCave]

This is still occurring Matt. 

We're seeing these 'Hidden User Created' detections for the Citrix 'CtxPkmService' alerts from AMP as recently as 15 minutes ago. 

[Matthew Franks]

Interesting. I'll reach out to the developers and see what we can do. Do you have a TAC case open I can reference?

Thanks,

-Matt

[Matthew Franks]

I'd suggest trying to update your signatures considering that is how it was resolved. 

In case that doesn't work, what connector version are you on?

-Matt

[TaylorOfTheCave]

I do see all of the clients who reported the FP also did Signature/Policy/Component updates within a few minutes of the detection so my expectation is that these clients had been offline since before the update was pushed via policy and they just did the scan/detection before they did the signature update. 

I've updated our TAC case to reference that it's likely due to an order-of-operations issue with the definition update and the scan.

[jplopper]

We had a similar issue that started on July 9 and continued to July 12.  Was correlated with a Citrix Receiver update.