BIOC - Powershell Script Based Alert Detection

KanwarSingh01 — Thu, 21 Apr 2022 23:13:55 GMT

We know that Cortex has the ability to use AMSI but is any one able to achieve a BIOC rule which can trigger an alert for the content inside the script.

Lets say if a Powershell script which is being run has certain parameters in the body such as "replace","Download","Invoke-WebRequest" etc...

Is it possible to create a BIOC rule for the content inside in the script?

Thanks in Advance.

Re: BIOC - Powershell Script Based Alert Detection

jtalton — Fri, 10 Jun 2022 21:01:47 GMT

Hi KanwarSingh01,

The Cortex XDR Agent features Behavioral Threat Protection modules leveraging the Anti-Malware Scan Interface (AMSI) to block PowerShell scripts.

To create a BIOC rule, please check out Live Community How-to video Script Block Query and BIOC | Palo Alto Networks

Thanks

topic BIOC - Powershell Script Based Alert Detection in Cortex XDR Discussions

BIOC - Powershell Script Based Alert Detection

Re: BIOC - Powershell Script Based Alert Detection