topic cortex XDR add SHA1 detection in Cortex XDR Discussions

cortex XDR add SHA1 detection

frank.f.lu — Thu, 07 Mar 2024 07:21:00 GMT

Does anyone know a way to detect for SHA1 on Cortex XDR?

Regarding IOC, it can't add SHA1 into hash type.

Regarding BIOC, for xdr_data, there is no columns to determine the SHA1 for a file or process:

Any ideas?

Re: cortex XDR add SHA1 detection

nsinghvirk — Tue, 12 Mar 2024 07:13:52 GMT

Hello @frank.f.lu

Thanks for reaching out on LiveCommunity!

Unfortunately SHA1 is not supported by Cortex XDR because Wildfire only support MD5 and SHA256 as hash types. Hence XDR can only provide verdict for MD5 and SHA256 hash types only.