FTP Transfer Custom BIOC

J.Gammara — Wed, 15 Jan 2025 22:28:25 GMT

Hello Palo Alto LiveCommunity,

I’m currently working on a task where I need to create a custom BIOC (Behavioral Indicator of Compromise) and add it to a restriction profile to block FTP command lines. Specifically, I want to prevent FTP-related commands from being executed by monitoring and restricting certain patterns.

I also need help with incorporating the following regex expression into the scope of action for a remote IP

it would be very appreciated if you have more details of how the BIOC must be created to block a process when it's associated with a restriction profile

An additional question is how BIOCs work when added as a Prevention Rule in a Restriction Profile.

I can see that some rules can generate locks killing the process, and others only detect, does anyone know how this capability works?

Re: FTP Transfer Custom BIOC

nsinghvirk — Thu, 16 Jan 2025 04:45:11 GMT

Hello @J.Gammara

Thanks for reaching out on LiveCommunity!

With BIOC rules, you can configure custom prevention rules to terminate the causality chain of a malicious process according to the Action Mode defined in the associated Restrictions Security Profile and trigger Cortex XDR Agent behavioral prevention type alerts in addition to the BIOC rule detection alerts.

For example, if you configure a custom prevention rule for a BIOC Process event, apply it to the Restrictions profile with an action mode set to Block, the Cortex XDR agent:

Blocks a process at the endpoint level according to the defined rule properties.

Triggers a behavioral prevention alert you can monitor and investigate in the Alerts table.

For more information on how to create a BIOC rule, please refer below doc.

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Create-a-BIOC-rule

You will find information on how to make a customer prevention rule using BIOC under heading "Configure a custom prevention rule".

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic FTP Transfer Custom BIOC in Cortex XDR Discussions

FTP Transfer Custom BIOC

Re: FTP Transfer Custom BIOC