topic Re: Tamper protection question in Cortex XDR Discussions

Tamper protection question

Cyber1985 — Mon, 25 Jul 2022 16:58:38 GMT

Hello dear live Community!

I found a very interesting link on Twitter and would like to know if there is any detection and/or prevention for this technique?

https://synzack.github.io/Blinding-EDR-On-Windows/

Rob

Re: Tamper protection question

mfakhouri — Fri, 29 Jul 2022 13:10:23 GMT

Hi Rob!

Thank you for submitting this coverage inquiry.

On Windows operating systems, Cortex XDR operates in the kernel space only. Because the Blinding EDR technique in the blog assumes that the EDR operates in the user space, this technique is not applicable to Windows endpoints running Cortex XDR.

Cortex XDR offers many valuable endpoint protection modules that may prove to be useful for this type of attack technique, such as tamper protection, behavioral threat protection, malicious file scanning, vulnerable driver protection, etc. Our engineers would love to investigate any proof-of-concept that you may have regarding the technique and can be reached out via support at support.paloaltonetworks.com.

Re: Tamper protection question

Cyber1985 — Sun, 31 Jul 2022 14:56:43 GMT

Thank you for your answer!

Rob