topic Re: BIOC Block executables based field "Process_File_Info" in Cortex XDR Discussions

BIOC Block executables based field "Process_File_Info"

agirones — Fri, 26 Apr 2024 09:05:15 GMT

Hello,

I would like to know if any of you have struggled with support and technical cases with the need I show below.

I would like to know what you can tell me or give me your opinion of blocking executables based on static metadata using the “Process_File_Info” field in the BIOC.

My intention is to block executables and not based on the executable name, because based on the executable name the BIOC stops matching if this executable name is modified.

Any suggestions?

Regards!

Re: BIOC Block executables based field "Process_File_Info"

agirones — Mon, 29 Apr 2024 06:29:23 GMT

Hello everyone,

I may not have explained myself in the best possible way, because this post has had 102 hits and no response.

So, the behavior we want to detect or restrict, is the use of an executable that we do not want to allow in our environment.

1. We do not want the BIOC to be based on the name of the executable because this name can be modified. 2.

2. We do not want the BIOC to be based on Hash, because an update or modification of the executable would not match with this hash.

I would appreciate if anyone has any suggestions.

About:
There is the field "Process_File_Info", which Palo Alto communicates:

PROCESS_FILE_INFO-Metadata of the process file, including file property details, file entropy, company name, encryption status, and version number.

But I cannot save the BIOC without getting the WILDCARD error.

Thanks and best regards!

Re: BIOC Block executables based field "Process_File_Info"

E.Jafarov — Sat, 23 Nov 2024 06:10:53 GMT

Hi agirones

You could search due to vendor signature, for example:

dataset = xdr_data |
filter event_type=ENUM.PROCESS |
filter (causality_actor_process_signature_vendor contains """Brave Software, Inc.""")