topic Re: Compile Payload Source Code Locally in Cortex XDR Discussions

Compile Payload Source Code Locally

VenuK — Tue, 24 Jan 2023 08:58:26 GMT

Dear Team,

We wanted to restrict compilers on our environment after a pentest resulted with Compile Payload Source Code Locally, we have common compilers like csc.exe and GCC/MinGW.

We wanted to know how to identify any common suspicious behavior exe's along with the csc.exe and GCC/MinGW compilers, suggest me the best way to restrict the compilers.

Re: Compile Payload Source Code Locally

eumbach — Wed, 25 Jan 2023 16:05:49 GMT

Hello @VenuK ,

We have used an active directory group to identify developers in our environment and then created a policy to allow for that AD group in XDR to run compilers.

We also are using a codesigning certificate to 'whitelist' any developer applications which follow the signing process.

Re: Compile Payload Source Code Locally

VenuK — Thu, 26 Jan 2023 04:27:49 GMT

Thank you @eumbach for the quick suggestion