https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-llmnr-nbt-ns-poisoning-querry/m-p/589226#M6816 <P>Hi guys, has anyone tried to create a correlation rule that detects LLMNR/NBT-NS poisoning attempts? or if Cortex XDR by default already detects</P> Tue, 11 Jun 2024 07:28:36 GMT R.SilvaOliveira 2024-06-11T07:28:36Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-llmnr-nbt-ns-poisoning-querry/m-p/589226#M6816 <P>Hi guys, has anyone tried to create a correlation rule that detects LLMNR/NBT-NS poisoning attempts? or if Cortex XDR by default already detects</P> Tue, 11 Jun 2024 07:28:36 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-llmnr-nbt-ns-poisoning-querry/m-p/589226#M6816 R.SilvaOliveira 2024-06-11T07:28:36Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-llmnr-nbt-ns-poisoning-querry/m-p/589787#M6830 <P>Hi&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/127411733">@R.SilvaOliveira</a>, thanks for reaching us using the Live Community.</P> <P>&nbsp;</P> <P>Looking at the attack behavior and the tactics used, all the behavior should be detected and blocked by the Cortex XDR agent on any of the protection modules, the BTP is the one with more chances to block.</P> <P>&nbsp;</P> <P>If this post answers your question, please mark it as the solution.</P> Tue, 18 Jun 2024 12:04:45 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-llmnr-nbt-ns-poisoning-querry/m-p/589787#M6830 jmazzeo 2024-06-18T12:04:45Z