https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bloodhound-detection/m-p/596648#M7139 <P>Does anyone know what ways exist in <LI-PRODUCT title="Cortex XDR" id="Cortex_XDR"></LI-PRODUCT>&nbsp;&nbsp;to detect if someone is running BloodHound?</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Tue, 03 Sep 2024 20:14:12 GMT tlmarques 2024-09-03T20:14:12Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bloodhound-detection/m-p/596648#M7139 <P>Does anyone know what ways exist in <LI-PRODUCT title="Cortex XDR" id="Cortex_XDR"></LI-PRODUCT>&nbsp;&nbsp;to detect if someone is running BloodHound?</P> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Tue, 03 Sep 2024 20:14:12 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bloodhound-detection/m-p/596648#M7139 tlmarques 2024-09-03T20:14:12Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bloodhound-detection/m-p/597326#M7170 <P>Hello&nbsp;<a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/307134">@tlmarques</a>&nbsp;</P> <P>&nbsp;</P> <P>Thanks for reaching out on LiveCommunity!</P> <P>If you have artefacts like hash, file name, file path, domains etc related to Bloodhound then you can&nbsp; utilise XDR's IOC/BIOC rules, correlation rules, XQL capabilities to create detections for it.</P> <P>Similarly if you have Customer support account with Palo Alto Networks then you can go to&nbsp;<A href="https://threatvault.paloaltonetworks.com/" target="_blank">https://threatvault.paloaltonetworks.com/</A>&nbsp;and search for Bloodhound in order to see XDR signatures and other artefacts for it.</P> <P>&nbsp;</P> <P>Please c<SPAN>lick&nbsp;</SPAN><STRONG>Accept as Solution</STRONG><SPAN>&nbsp;to acknowledge that the answer to your question has been provided.</SPAN></P> Mon, 09 Sep 2024 16:06:40 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/bloodhound-detection/m-p/597326#M7170 nsinghvirk 2024-09-09T16:06:40Z