block vulnerable applications from running

Hisashi_Abe — Thu, 03 Oct 2024 16:48:35 GMT

Hi community,

I am attempting with restricting the execution of vulnerable applications.

Is it possible to block a specific application version using BIOC associated with restriction profile?
(Or if there's another easy way to do this please let me know)

Re: block vulnerable applications from running

nar — Thu, 03 Oct 2024 17:51:05 GMT

Hi @Hisashi_Abe

Thank you for reaching out to the Live community!

You can use the restriction profile and call the executable/application there - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-New-Restrictions-Security-Profile

In case if you are looking to block the specific version of that application then you may need to check the hash of that version which may be unique with each release so that you can add it to the block list - https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-File-Execution

For more granular restriction you can check for other parameters/variables of that application and make use of BIOC rules by adding them to the restriction profile.

Please click Accept as Solution to acknowledge If this answer added value to your question.

topic block vulnerable applications from running in Cortex XDR Discussions

block vulnerable applications from running

Re: block vulnerable applications from running