Focus

Tampering Events

Table of Contents

Tampering Events

Tampering events are generated when Prisma Browser detects unauthorized modifications to its files, processes, network communications, or engine integrity.

Event Types

Event Type	UI Name	Description
fileTampering	File tampering	Browser files were modified outside of the normal update process
talonEngineTampering	Engine tampering	Prisma Browser security engine was tampered with
processTampering	Process tampering	An unauthorized process attached to or modified the browser process
networkTampering	Network tampering	Browser network communications were intercepted or modified
pbInfraNetworkTampering	Infra network tampering	Prisma Browser infrastructure communications were tampered with
mobileAppTampering	Mobile app tampering	Prisma Browser mobile application integrity was compromised
rceExploitAttempt	RCE exploit attempt	A remote code execution exploit was detected and blocked

Context Fields

Field	UI Label	Description
tampering.type	Description	The specific type of tampering detected

Tampering Types — Desktop (Windows/macOS)

The tampering.type field provides detailed information about what was detected:

Tampering Type	Description
Browser binary modified	Prisma Browser executable was modified after installation
Internal file modified	An internal browser file was modified outside the update process
Debugger attached	A debugger was attached to the browser process
Restricted CLI args used	The browser was launched with restricted command-line arguments

Tampering Types — Network / Infrastructure

Tampering Type	Description
Invalid Talon infrastructure certificate	An invalid TLS certificate was detected on infrastructure communication
Invalid trust store certificate	The browser trust store was modified with an unauthorized certificate
Talon infrastructure message changed	A message in the infrastructure communication channel was altered

Tampering Types — Mobile (Android/iOS)

Tampering Type	Description
Frida detected	The Frida dynamic instrumentation toolkit was detected on the device
Emulator detected	The application is running in an emulator rather than a real device
Unknown installer	The application was installed from an unknown/untrusted source
App not installed	The application integrity check found the app is not properly installed
App UID mismatch	The application user ID does not match expected values
Cloud project number is invalid	The Firebase/GCP project number is invalid
Request hash too long	The integrity attestation request hash exceeds allowed length
Expired token	The integrity attestation token has expired
Invalid token	The integrity attestation token is invalid
Invalid package name	The application package name does not match expected values
Forbidden package name	The application package name is on the forbidden list
Invalid request hash	The integrity request hash is invalid
Invalid request timestamp	The integrity request timestamp is outside the valid window
Invalid app recognition verdict	The Play Integrity app recognition verdict indicates tampering
Empty device recognition verdict	The device integrity check returned no verdict
Invalid device recognition verdict	The device failed integrity verification
Invalid app licensing verdict	The app licensing verification failed

Process Context

When available, process information is included with tampering events:

Field	UI Label	Description
process.pid	Process ID	The process identifier
process.imagePath	Process image path	The full path to the process executable
process.cliArgs	Process Command-Line arguments	The command-line arguments used to launch the process
process.parentProcess.imagePath	Parent process path	The parent process executable path

Certificate Context

For network and infrastructure tampering events involving certificates:

Field	UI Label	Description
certificate.issuer	Certificate issuer	The certificate issuer name
certificate.subject	Certificate subject	The certificate subject name
certificate.serialNumber	Serial number	The certificate serial number
certificate.createdTime	Created	Certificate creation timestamp
certificate.expirationTime	Expiration	Certificate expiration timestamp
certificate.fingerprints[].value	Fingerprint	Certificate fingerprint hash value
certificate.fingerprints[].algorithm	Algorithm	Hash algorithm used (MD5, SHA-1, SHA-256, SHA-512)

RCE Exploit Context

The rceExploitAttempt event is generated when the browser detects an attempted remote code execution exploit (e.g., via WebAssembly-based attacks):

Field	UI Label	Description
rceExploit.sensor	Detection Sensor	The sensor that detected the exploit (e.g., WASM_GUARD)
rceExploit.url	Exploited URL	The URL where the exploit was attempted

Examples

File Tampering — Browser Binary Modified

Field	Value
Type	File tampering
Category	Tampering
User	unknown.user@acme.com
Tampering type	Browser binary modified
Process ID	4521
Process image path	C:\Program Files\Prisma Browser\browser.exe
Action	Blocked
Severity	Very high
OS	Windows 11

Process Tampering — Debugger Attached

Field	Value
Type	Process tampering
Category	Tampering
User	dev.engineer@acme.com
Tampering type	Debugger attached
Process ID	8892
Process CLI arguments	--remote-debugging-port=9222
Action	Blocked
Severity	Very high

Network Tampering — Invalid Infrastructure Certificate

Field	Value
Type	Infra network tampering
Category	Tampering
User	jane.doe@acme.com
Tampering type	Invalid Talon infrastructure certificate
Certificate issuer	CN=Unknown CA
Certificate subject	CN=*.prisma-browser-infra.com
Action	Blocked
Severity	Very high

Mobile App Tampering — Frida Detected

Field	Value
Type	Mobile app tampering
Category	Tampering
User	mobile.tester@acme.com
Tampering type	Frida detected
Action	Blocked
Severity	Very high
Device	PIXEL-7-PRO
OS	Android 14

RCE Exploit Attempt

Field	Value
Type	RCE exploit attempt
Category	Tampering
User	bob.jones@acme.com
Exploited URL	www.compromised-blog.net/article/malicious
Detection Sensor	WASM_GUARD
Action	Blocked
Severity	Very high
OS	Windows 11

Browser Security Events

PIN Code Events