topic Bad Driver Blocks in Cortex XDR Discussions

Bad Driver Blocks

Cyber1985 — Sun, 04 Sep 2022 07:25:06 GMT

Hello dear community,

Are these drivers, signers, etc. blocked by CORTEX XDR Pro?

it is a copy of the official provided list from Microsoft.

https://github.com/Harvester57/CodeIntegrity-DriverBlocklist/blob/99534db767c7c71826fa70d43f28a25b3cf7d2ba/RecommendedDriverBlock_Insider.xml

Is there a official statement or ressource from PA for bad drivers, etc. which makes me sleep bether?

Rob

Re: Bad Driver Blocks

neelrohit — Sun, 04 Sep 2022 09:30:43 GMT

Hello @Cyber1985 ,

Thank you for reaching out on Live Community!

Cortex XDR looks looks upon behaviour of execution and driver loading and dropping activity. For any malicious activity, it will be blocked under Behavioural Threat Protection module rules and heuristics.

We additionally also rely on sources of vulnerable drivers, one of the most prominent one that can be shared is from microsoft drivers block rules list:

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules

Hope that answers your question.

Regards.

Re: Bad Driver Blocks

Cyber1985 — Sat, 17 Sep 2022 07:32:32 GMT

Exactly this was the answer, I expected!

Thank you for the transparency!

Rob