XDR - portproxy enabled allow a man-in-the-middle attack

tlmarques — Fri, 26 Apr 2024 14:59:25 GMT

Hi

Does anyone know if detect and/or protect against this type of attack:

Windows 10 must not have portproxy enabled or in use (syxsense.com)

Re: XDR - portproxy enabled allow a man-in-the-middle attack

jmazzeo — Fri, 26 Apr 2024 20:07:18 GMT

Hi @tlmarques, thanks for reaching us using the Live Community.

I did a test in my lab by modifying the registry as mentioned in the link, and it was not detected by the XDR Agent as malicious.

In this cases you can create custom BIOCs to detect this behaviors that might not be malicious by themselves.

I have created this custom BIOC rule that you can apply in Detection Rules - BIOC - Add Bioc to detect modifications to this registry key.

dataset = xdr_data | filter event_type = ENUM.REGISTRY and event_sub_type = ENUM.REGISTRY_CREATE_KEY | filter action_registry_key_name contains """HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\PortProxy\\"""

Tested and working as expected:

You can even add the BIOC to a Restriction Profile and block the process doing the registry modification.

If this post answers your question, please mark it as the solution.

topic XDR - portproxy enabled allow a man-in-the-middle attack in Cortex XDR Discussions

XDR - portproxy enabled allow a man-in-the-middle attack

Re: XDR - portproxy enabled allow a man-in-the-middle attack