topic Re: Cortex xdr did not detect malware, what good is it? in Cortex XDR Discussions

Cortex xdr did not detect malware, what good is it?

SimonTan — Fri, 17 Jul 2020 21:41:44 GMT

Cortex XDR did not detect malware, what good is it?

I got this scan with mal warebytes. 41 detected.

Re: Cortex xdr did not detect malware, what good is it?

dfalcon — Fri, 17 Jul 2020 22:13:29 GMT

Just curious, did you try to run these binaries or leverage a scan. What enforcement did you specify in your profiles / policy rules? On the malware side there are several checks:

WildFire

WF Static Analysis
Machine Learning
Dynamic Analysis
Bare Metal

for unknown, the local analysis should do the examination at the point of execution.

In addition to the malware prevention, Cortex XDR includes behavior threat protection, anti-ransomware, password theft protection, child process protection, and approximately 30 ways to exploitation.

If you are using a scan for dormant malware, it is not the same as having all of the different protection levels that are leveraged during point of execution. Are you able to share any hash / artifact info for verification?

Re: Cortex xdr did not detect malware, what good is it?

dfalcon — Tue, 21 Jul 2020 15:50:43 GMT

Hi @SimonTan-

I would actually be happy to set up a Zoom with you to look over your configuration. Based on your screenshot from MB, I believe that you may not have Cortex XDR configured to your needs. For instance, in your screenshot, I see a large number of Potentially Unwanted Applications. These are not malware. Cortex XDR can be configured to treat these the same as malware. On the malware side, I'd be very interested in checking into these as well.

Please let me know if you would like to set up a session.

Re: Cortex xdr did not detect malware, what good is it?

SimonTan — Tue, 21 Jul 2020 17:17:28 GMT

how to retrieve a support file and malware scan log?

Re: Cortex xdr did not detect malware, what good is it?

dfalcon — Tue, 21 Jul 2020 19:26:06 GMT

Right click on that entry and select Additional Data.

Once in the details screen, right click on the entry in the list to download the TSF.

Re: Cortex xdr did not detect malware, what good is it?

dfalcon — Tue, 21 Jul 2020 19:28:45 GMT

On the malware scan log. Same thing. Right click on the entry within the All Actions interface and select additional data.

From there, locate the entry, right-click and select View Related Alerts.

Re: Cortex xdr did not detect malware, what good is it?

SimonTan — Tue, 21 Jul 2020 19:48:52 GMT

got it, send file to the tech and see what they say.

Re: Cortex xdr did not detect malware, what good is it?

Balaraju — Fri, 18 Mar 2022 17:16:42 GMT

Hello , Is there any document or link which can summarise all the protection capabilities of Cortex XDR ? There seem to be many modules/techniques but what is lacking is not all are listed at one place and its difficult to understand how it all works in real world and deliver protection , so list all protection capabilities/modules and give a brief of what each of them achieve .

Re: Cortex xdr did not detect malware, what good is it?

kcross — Fri, 18 Mar 2022 17:38:37 GMT

Please take a look at: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-concepts/endpoint-protection-modules.html and https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-concepts/analysis-and-protection-flow.html#idc8514e04-490b-498a-b9ca-b68dfc5be3d4

Let me know if this helps.

Re: Cortex xdr did not detect malware, what good is it?

Balaraju — Fri, 18 Mar 2022 17:49:59 GMT

Thanks for quick reply , I will refer this surely .

Re: Cortex xdr did not detect malware, what good is it?

eluis — Sat, 19 Mar 2022 14:55:23 GMT

Hi @SimonTan,

do not think of CXDR as a regular AV non stop scanning everything, we are not doing that. Even though you can schedule periodic scans we do not recommend to do then daily or frequently. This consumes a huge amount of resources to discover the known malicious files which wont be able to run anyways due to WF, local analysis at exec time, BTP, ... Dangerous attacks usually never come from known hashes

We do check files when the users is going to execute because then, is when the file can turn into a real threat and at this time we discover and stop the unknown as well as the known threats. And at that time we will stop them, and report it to alerts and incidents. Additionally you have a number of actions to do with files afterwards treating them as malware and delete them, quarantine them, allow them if they happen to be benign even the initial behavior was triggered as malicious...

Be confident that with CXDR you will be protected from the known and even much better "from the unknown".

These detections that you showed that were not discovered by CXDR is because the were not scanned by CXDR ? or nobody tried to execute them.

Realize that even if you try a file that goes unknown from a hash check in any AV (CXDR included) when you try to execute it we will analyse at pre-execution and execution time, putting it in context with parent and child processes it might try to create. And whenever we detect something suspicious we will stop/block it and report it on the form of alerts and group them (the related alerts) within incidents for further investigation and incident response.

KR,

Luis

Re: Cortex xdr did not detect malware, what good is it?

KanwarSingh01 — Sat, 02 Apr 2022 20:01:41 GMT

How would you setup CXDR to treat PUA as malwares?

Re: Cortex xdr did not detect malware, what good is it?

eluis — Sun, 03 Apr 2022 14:36:44 GMT

Hi @KanwarSingh01 ,

Im just thinking fast and on the fly you might think of doing several things:

adding hashses to block list
tweaking WF verdicts to malicious if they are triggered to bening or unknown. You might even ask for suex through TAC cases if needed
If you know or suspect that they are usually dropped at user download folders, ban the execution from that folder (you might even do such with AD GPO)
Treat unknown as malware
Check howtos here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/endpoint-security-profiles/add-malware-security-profile.html

Re: Cortex xdr did not detect malware, what good is it?

jcandelaria — Mon, 04 Apr 2022 04:05:44 GMT

Hi @KanwarSingh01

Alot of the PUA are considered grayware, there is an option on malware profile

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-profiles/add-malware-security-profile

Grayware
—The sample does not pose a direct security threat, but might display otherwise obtrusive behavior. Grayware typically includes adware, spyware, and Browser Helper Objects (BHOs).

As @eluis mentioned, you can manually add the hashes to the block list.

Also you can do restriction profile as an option

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-profiles/add-restrictions-profile

Re: Cortex xdr did not detect malware, what good is it?

KanwarSingh01 — Mon, 04 Apr 2022 04:48:54 GMT

@eluis and @jcandelaria

I though there might be some other way which i might be missing out for catching PUAs, hence the question. I think I am fine with the discussion, PUAs are never ending topics i.e. every SecOps guy has its own terminology for PUAs and they are not threat to orgs directly and also can never be full proof prevention in stopping all PUAs.

Good example: NSSM.exe (A service wrapper on Windows) is used for service installation of services like ELK on windows but can also be used in an attack for persistence.🙂

Thanks @eluis @jcandelaria

Re: Cortex xdr did not detect malware, what good is it?

eluis — Mon, 04 Apr 2022 10:16:48 GMT

Hi @KanwarSingh01

another action to take relatedf to this PUAs is to clarify in your securiry policies internally what your organization considers a PUA, what is allowed and what is not. After that you can totally prohibit in profiles or through hashes added to block-list the apps that you consider in your internal policies as unwanted.

KR,

Luis