FTP Transfer BIOC

J.Gammara — Tue, 14 Jan 2025 16:46:57 GMT

Hello Palo Alto LiveCommunity,

I’m currently working on a task where I need to create a custom BIOC (Behavioral Indicator of Compromise) and add it to a restriction profile to block FTP command lines. Specifically, I want to prevent FTP-related commands from being executed by monitoring and restricting certain patterns.

I also need help with incorporating the following regex expression into the scope of action for a remote IP

it would be very appreciated if you have more details of how the BIOC must be created to block a process when it's associated with a restriction profile

Re: FTP Transfer BIOC

BPry — Tue, 14 Jan 2025 22:49:57 GMT

@J.Gammara,

You might have better luck posting this in the Cortex XDR specific discussion forum. There's a couple folks who at least monitor that on a somewhat regular basis that pick up your discussion and be able to help a bit more. You would need to really test your regex to ensure that this doesn't capture too much; it's a bit of a risky exercise honestly.

You'll need to attempt to account for various FTP methods if I understand your end goal appropriately. As an example, you can utilize wget ftp://myftpsite.com, you can utilize FTP directly, CURL, and about a million other utilities. Your most common "catch" would just be building an indicator for ftp://anything and attempt to build something for ftp itself that isn't going to be overly broad and capture more than you want.

I'd also just toss out that building a firewall rule to limit FTP and alert on any denied FTP sessions would likely actually be an easier path forward and still allow you to alert on unexpected/denied FTP traffic.

topic FTP Transfer BIOC in General Topics

FTP Transfer BIOC

Re: FTP Transfer BIOC