topic Re: WMIC MDE exclusions in Cortex XDR Discussions

WMIC MDE exclusions

RFeyertag — Wed, 21 Jun 2023 21:15:09 GMT

Hello dear community,

do we need to setup our own bioc, or will this come as a standard rule from PA?

https://twitter.com/malmoeb/status/1671453836605550592

Rob

Re: WMIC MDE exclusions

anlynch — Thu, 22 Jun 2023 18:59:56 GMT

Hi @RFeyertag,

Thanks for reaching out.

This is a really interesting thread and thanks for sharing with the community. When I first saw this question I wasn't 100% sure if Cortex XDR would protect this out of the box. This definitely looks like a novel technique to me. I wasn't even sure you could use WMIC in that way.

With that being said I decided I need to test to find the answer to your question. I am happy to report that Cortex XDR detected and blocked the action. Please see the shots below.

Thanks for sharing this with the community and I hope you find this information helpful!

Have a great day!

Re: WMIC MDE exclusions

RFeyertag — Thu, 22 Jun 2023 21:26:43 GMT

Hello @anlynch!

thank you so much for giving us this result from your test!!

Rob