topic Cortex does not block Windows binaries in Cortex XDR Discussions

Cortex does not block Windows binaries

RonaldWeiss — Tue, 31 May 2022 09:12:51 GMT

To mitigate cve-2022-30190 i wanted to add the file hashes of the msdt.exe binary to the blocklist; but with no effect until now.
The hashes occure in the logfile of the agent below hashcontrol as enabled, but verdict has a value "0".
Is it possible, that windows binaries are excluded from blocking by default?
i decided to block the binary for mitigation, because it's a minimal-invasiv approach, which can be reverted quickly if the issue is patched.

Re: Cortex does not block Windows binaries

evillegas1992 — Tue, 31 May 2022 17:59:28 GMT

Te sugiero sigas los siguientes pasos publicados por Microsoft hasta que tengas una respuesta por parted e Cortex Palo Alto.

https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/

Re: Cortex does not block Windows binaries

RonaldWeiss — Wed, 01 Jun 2022 06:59:54 GMT

Hello,

as Luc mentioned here (https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/m-p/496106/highlight/true#M2073 ) the use of custom prevention rules with the BIOC works lika a charm here.

So, this will be my solution until PA or Microsoft deliver a proper one. (Which, for PA, might be a BIOC, too 😉 )