Bad Driver Blocks

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Bad Driver Blocks

L3 Networker

Hello dear community, 

 

Are these drivers, signers, etc. blocked by CORTEX XDR Pro? 

it is a copy of the official provided list from Microsoft. 

 

https://github.com/Harvester57/CodeIntegrity-DriverBlocklist/blob/99534db767c7c71826fa70d43f28a25b3c...

 

Is there a official statement or ressource from PA for bad drivers, etc. which makes me sleep bether? 

 

BR

 

Rob

1 accepted solution

Accepted Solutions

L5 Sessionator

Hello @Cyber1985 ,

 

Thank you for reaching out on Live Community!

 

Cortex XDR looks looks upon behaviour of execution and driver loading and dropping activity. For any malicious activity, it will be blocked under Behavioural Threat Protection module rules and heuristics.

 

We additionally also rely on sources of vulnerable drivers, one of the most prominent one that can be shared is from microsoft drivers block rules list:

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-con...

 

Hope that answers your question.

 

Regards.

View solution in original post

2 REPLIES 2

L5 Sessionator

Hello @Cyber1985 ,

 

Thank you for reaching out on Live Community!

 

Cortex XDR looks looks upon behaviour of execution and driver loading and dropping activity. For any malicious activity, it will be blocked under Behavioural Threat Protection module rules and heuristics.

 

We additionally also rely on sources of vulnerable drivers, one of the most prominent one that can be shared is from microsoft drivers block rules list:

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-con...

 

Hope that answers your question.

 

Regards.

Exactly this was the answer, I expected! 

Thank you for the transparency! 

 

BR

 

Rob

  • 1 accepted solution
  • 2073 Views
  • 2 replies
  • 0 Likes
  • 78 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!