topic Re: CVE-2023-36884 - Does Cortex XDR Pro cover this CVE? in Cortex XDR Discussions

CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

RFeyertag — Wed, 12 Jul 2023 12:26:39 GMT

Hello dear LIVEcommunity!

Should we follow the recommendation from microsoft or does cortex xdr pro cover this CVE?

https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/

Rob

Re: CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

neelrohit — Wed, 12 Jul 2023 12:50:13 GMT

Hi @RFeyertag ,

Thank you for writing to live community!

We have not yet found any internal updates on the same and would request you to open a support case for coverage assessments. We would be happy to hear from you in circumstance, you get any updates for the same.

Please feel free to mark the response as "Accept as Solution" if it answers your query

Re: CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

neelrohit — Thu, 13 Jul 2023 03:15:34 GMT

Hi @RFeyertag ,

As per some latest updates, you can find updated information on coverage on our unit42 blog post: https://unit42.paloaltonetworks.com/cve-2023-36884-rce/

hope this helps.

please mark the response as “Accept as Solution” if it answers your query so that others could navigate to this solution

Re: CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

RFeyertag — Fri, 14 Jul 2023 21:01:41 GMT

@neelrohit: Thank you very much!

Rob

Re: CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

RFeyertag — Thu, 27 Jul 2023 22:34:23 GMT

There are no queries like mentioned in the blog post:

Rob

Re: CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

PiyushKohli — Fri, 28 Jul 2023 04:42:12 GMT

Hi @RFeyertag

Thanks for highlighting. Let me check and will update here on this.

Thank You

Re: CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

micomi — Fri, 28 Jul 2023 08:56:09 GMT

Hi @RFeyertag

These are probably not the queries mentioned in the threat brief but Palo Alto released a XSOAR playbook. In this playbook you can find some XQL hunting queries.

https://cortex.marketplace.pan.dev/marketplace/details/CVE_2023_36884__Microsoft_Office_and_Windows_RCE/

Re: CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

RFeyertag — Sun, 30 Jul 2023 13:04:07 GMT

Hello @micomi!

I think one of these scripts needs some adjustment (the other Office Applications are missing too):

Maybe you can forward it to the right people?

Rob

Re: CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

micomi — Mon, 31 Jul 2023 05:43:57 GMT

Hi @RFeyertag

Good point but I can't forward this to the right people. I'm not from Palo Alto but perhaps someone else can forward this topic

Re: CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

bmelamed — Wed, 02 Aug 2023 10:18:58 GMT

Hey,

We've released a fix for that XQL query. Will be available in the marketplace soon.

Ben