topic Re: True Positive / no incident / evasion / self made alerts helped to detect in Cortex XDR Discussions

True Positive / no incident / evasion / self made alerts helped to detect

RFeyertag — Tue, 05 Sep 2023 16:15:33 GMT

Hello dear community,

got an 2 hour infection on a fat client from this https://www.virustotal.com/gui/file/79e3e243726a8b29b4cf74576e364ce98dfadb5bd182d8d1ed55255e70defc2c/details

This little guy was evading cortex xdr pro.

Whatch out and fill your blocklist, because they getting better and better.

Initial access was a google drive link and the pw protected rar/zip with about 120 MB size.

If you are interested with wich self made bioc we detected it let me know.

Rob

Re: True Positive / no incident / evasion / self made alerts helped to detect

anlynch — Wed, 06 Sep 2023 14:48:07 GMT

Hi @RFeyertag,

Thanks for sharing this with the community!

Re: True Positive / no incident / evasion / self made alerts helped to detect

RFeyertag — Wed, 06 Sep 2023 20:53:40 GMT

Hey @anlynch!

it would be nice if there could be a new rule for process which is not browser communicating to steamcommunity and/or t.me. And this rule should terminate this process.

Because wildfire is not getting a 300 MB scr file to analyze. So it flew completely under the radar.

This is one of the best evasion technique I've ever seen and I am a little bit proud that I detected it with much efort creating new rules to detect this peace of best stealer trojan.

Rob

Re: True Positive / no incident / evasion / self made alerts helped to detect

PiyushKohli — Fri, 08 Sep 2023 02:13:45 GMT

Hi @RFeyertag

For Cortex XDR coverage information, please submit a TAC case and share your observation and workaround you did on the same for team to review and update.

Thanks