topic Re: Yara Rules and Cortex XDR in Cortex XDR Discussions

Yara Rules and Cortex XDR

KanwarSingh01 — Sat, 02 Apr 2022 19:49:57 GMT

I have seen alerts screenshot on internet where an alert triggered after matching a Yara rules.

https://attackevals.mitre-engenuity.org/enterprise/participants/paloaltonetworks?adversary=carbanak-fin7&view=results&scenario=1

(Fourth Screenshot)

Does Cortex XDR uses Yara Rules? I mean the screenshot answers it but how? Do we need to upgrade on a specific version of XDR agent? Can we build our own custom yara rules?

https://www.paloaltonetworks.com/cortex/cortex-xdr

Would love to understand how it works.

Re: Yara Rules and Cortex XDR

bbarmanroy — Tue, 05 Apr 2022 01:42:26 GMT

Hi @KanwarSingh01 Cortex XDR uses several protection modules both on the agent as well as on the tenant-side, including integrations with Wildfire as well as other integrations (e.g. VirusTotal) that you may have added to your tenant. They range from behavioral techniques (BTPs/BIOCs), ML models, malware and exploit protection modules, YARA signatures, sandboxes, local analysis etc. These protection modules are both pre-execution and post-execution in nature, as well as both detective/preventative in nature.
Customers are not able to tune YARA rules in XDR as that is entirely evolving in the backend and is managed by dedicated Threat Hunters, malware researchers and exploit researchers.
Lastly, your tenant modules are seamlessly upgraded to respond to evolving threats and attacks as observed by the relevant domain experts. On the agent side, please ensure that the CU's are rolled out ASAP while being inline with your organizational security policies. The agents themselves should also be regularly updated to address the vulnerabilities/capability improvements that are packaged with each new minor/maintenance release.

Please go through this article that talks about XDR's capabilities with recent malware in-the-wild that touches upon the various levels of protection within XDR.

Re: Yara Rules and Cortex XDR

KanwarSingh01 — Tue, 05 Apr 2022 20:30:58 GMT

Thanks @bbarmanroy are there any plans of integrating Custom Yara Rules in the future?

Re: Yara Rules and Cortex XDR

bbarmanroy — Wed, 06 Apr 2022 02:07:42 GMT

We are discussing this internally to see what can be done. On a tactical basis, if you're having any issues with any detections, please raise a support ticket.

Re: Yara Rules and Cortex XDR

KanwarSingh01 — Wed, 06 Apr 2022 05:25:41 GMT

Not having issues just questions.

Thank you.

Re: Yara Rules and Cortex XDR

MarkusMix — Mon, 26 Jun 2023 17:11:10 GMT

We have a need for custome Yara rules as well.

Other vendors like Trend Micro do have this already implemented.

Any news from internal discussions @bbarmanroy?