BIOC - suggestion for improvement

Hey ho!

I've a suggestion for improvement:

BIOC - Browser downloads an .hta or .application file --> You could insert also brave browser.

iexplore.exe|chrome.exe|firefox.exe|opera.exe|microsoftedge.exe|microsoftedgecp.exe|safari.exe

Thanks

BR

Rob

Device control violation alert\bioc

Im looking for a way to alert when a device control violation occurs

Currently ive not found a xql query that works

Trapsd.log contains allowed files in restriction profile

Is it normal behavior that the trapsd.log file contains the list of allowed files in my restriction profile.

Since this is only names of files and not hashes, an attacker could take advantage of this list

Confluence Server and Data Center - CVE-2022-26134

Wondering where Cortex is at with this Critical vuln from Atlassian? We are actively moving forward with mitigations, but would like Cortex to be able to take action as well if needed. 

Confluence Security Advisory 2022-06-02 | Confluence Data Center

Cortex Linux Agent Debian Package messed up

Hi,

Starting with Version 7.7 the downloadable Package is still named *.deb, in fact it is a tar.gz containing the following:

-config file

-readme

-deb-file

Which means, you cannot just install the so-called "deb package", but you have to create a directo

CVE-2022-30190 - Microsoft Support Diagnostic Tool Vulnerability

Does Cortex XDR Prevent protect against CVE-2022-30190 (Microsoft Support Diagnostic Tool Vulnerability)?

Thank you!

Cortex does not block Windows binaries

To mitigate cve-2022-30190 i wanted to add the file hashes of the msdt.exe binary to the blocklist; but with no effect until now.
The hashes occure in the logfile of the agent below hashcontrol as enabled, but verdict has a value "0".
Is it possible, t

XQL - Hunt for Possible Spring4Shell Vulnerable Application

Brief:

Spring4Shell Vulnerability Exists in the Spring Framework. Java based application are developed using this framework, we would not see direct installation of spring framework on the system but as part of a Java application. (At least what I hav

A large number of port scans

Hi guys! 

Recently, we often encounter incidents associated with a large number of port scans in Cortex XDR. We assume that this started after the last update. Does anyone else have something similar?

Thank you!

Cortex blocking hashes in allowed list

Hello ,

Just wondering why does cortex block hashes that are already part of allow list sometimes ?