Cortex XDR don't alert when using WinPeas.bat

wbpdki — Thu, 11 May 2023 07:11:05 GMT

Good morning,
We have noticed that when using LinPEAS on Linux systems, Cortex XDR reacts, blocks and alerts. However, using WinPEAS bat script on Windows systems is not detected by Cortex. However winpeas.exe is blocked immediately.

For testing purposes we used linpeas.sh and winpeas.bat from:

carlospolop/PEASS-ng: PEASS - Privilege Escalation Awesome Scripts SUITE (with colors) (github.com)

Why Cortex doesn't react when malicious .bat script is used?

Thanks in advance.

Re: Cortex XDR don't alert when using WinPeas.bat

mavraham — Sun, 14 May 2023 13:51:04 GMT

Hi @wbpdki, thank you for writing to Live Community.

You're saying Winpeas.exe was blocked immediately, but WinPEAS bat script went undetected?

Please allow me some time to test it and get back to you.

topic Cortex XDR don't alert when using WinPeas.bat in Cortex XDR Discussions

Cortex XDR don't alert when using WinPeas.bat

Re: Cortex XDR don't alert when using WinPeas.bat