Usercentric.Exe on MS Teams

PGP1234 — Tue, 22 Feb 2022 01:31:12 GMT

Hi,

There are recent articles on MS Teams security incident. Attackers attach usercentric.exe files to Teams chats to install a Trojan on the end-user's computer. This Trojan is then used to install malware that self-administers the computer.

Does Cortex XDR detect this?

If yes, how? If not, what are the other mitigations we can do?

Are there particular hashes to be blocked?

Link: https://www.avanan.com/blog/hackers-attach-malicious-.exe-files-to-teams-conversations

Re: Usercentric.Exe on MS Teams

bbarmanroy — Tue, 22 Feb 2022 06:13:31 GMT

Hi @PGP1234 The attack vector can be Teams, emails, or any other communication tool that is being used by a malicious actor to compromise an end-user. That is the first-stage dropper that is then used to gain persistence and/or perform malicious activities on the endpoint etc.

How Cortex XDR detects this: behaviorial analysis. XDR will monitor all running processes and look at the actions being performed (registry entries, network activities, disk activities etc.) Take a look at this document, which explains the capabilities of Cortex XDR in detail: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-concepts/about-cortex-xdr-protection.html

The payload can evolve over time, as can the second- or third-stage payloads. Blocking via hash is a tactical fix, and not to be confused with a strategic fix. The fix can be on multiple levels: firewalls, endpoints, permissions review, user awareness etc.

topic Re: Usercentric.Exe on MS Teams in Cortex XDR Discussions

Usercentric.Exe on MS Teams

Re: Usercentric.Exe on MS Teams