topic Re: Best Simulated (Fake) Malware To Use With Cortex XDR in Cortex XDR Discussions

Best Simulated (Fake) Malware To Use With Cortex XDR

chukaokonkwo — Tue, 15 Mar 2022 21:29:58 GMT

Hi all,

Do you all know what the best simulated malware is to use in testing out rules/responsiveness/etc on Cortex XDR and where to download these fake malware from. Ideally it'll be benign specially constructed so they trigger same alerts as actual malware.

A dozen high-fives for tips, suggestions, participation, etc.

Re: Best Simulated (Fake) Malware To Use With Cortex XDR

MarvinC — Tue, 15 Mar 2022 23:00:46 GMT

Hi @chukaokonkwo ,

Hope this will be relevant to what you are looking for.

These are PA Malware Test File.

https://docs.paloaltonetworks.com/wildfire/9-0/wildfire-admin/submit-files-for-wildfire-analysis/verify-wildfire-submissions/test-a-sample-malware-file

When I tested this before, this will just trigger WF alerts.

If you are looking in particular like sample malware that trigger BTPs maybe opening a ticket to the support team can help you with this.

Re: Best Simulated (Fake) Malware To Use With Cortex XDR

eluis — Wed, 16 Mar 2022 09:44:31 GMT

Hi Chukaokonkwo,

additionally to my colleague's link with WF trigerring malware. I would recomend you to install SANS malware analysis and reverse engineering tranining samples on a "Virtual Machine" (because this is real malware) and test it under a closed and controlled environment where you can play with CXDR agent and real malicious stuff. Ive done this before and even tested Forensic Module to see the traces from artifacts and evidences on prefetches, registry to gain persistance ....

I cant remember now a website where you could download even ransomware samples like wannacry, NOT-Petya... and play with it to see that our agents will block it
Anyways if you find another interesting samples feel free to share here with the community.

And watch out, always test on a closed VM to not to damage any real asset in production

KR,

Luis

Re: Best Simulated (Fake) Malware To Use With Cortex XDR

KanwarSingh01 — Sat, 02 Apr 2022 20:21:55 GMT

@chukaokonkwo @eluis

If you would like to simulate a fake attack and use free of cost tool. Please check out Infection Monkey

https://www.guardicore.com/infectionmonkey/

This should definitely trigger Cortex XDR (Red, Yellow, Blue and Grey)

If you would like to fetch some real stuff, you can use URLHaus and browse to malware links which are tagged with Office Doc Tags such as xlsx, docx etc and download, run it in a controlled environment away from production systems or any critical system.

Note: I would personally recommend not to take this route as you will be exposing yourself to real Threat Actors if corrective measures are not taken by yourself.

Re: Best Simulated (Fake) Malware To Use With Cortex XDR

eluis — Sun, 03 Apr 2022 14:58:08 GMT

Thanks @KanwarSingh01 !!! it all adds up