Blocking EFSRPC

[Kyle_Begle]

In the 7/17 content release notes, improvements have been made to "Suspicious Encrypting File System Remote call (EFSRPC) to domain controller' generated by XDR Analytics BIOC detected on 2 hosts."

By default, the action for this is to detect/alert. I would like to change this to block. Does anyone know how to accomplish this? Better yet, what is the best way to determine which cortex settings/policies apply to a specific Incident? Is there some master list of Incident types and respective settings?

I looked through Prevention Profiles and could not find a setting that makes sense for the EFSRPC alert. Thanks in advance for any help you can provide.

[anlynch · Accepted solution]

Hi @Kyle_Begle,

Thanks for reaching out on LIVEcommunity!

In regards to the rule you're mentioning it is an analytics BIOC.  This means there is not block functionality associated with it.  Analytics BIOCs are not produced in real time and therefore cannot block. Please take a look at the Analytics Concepts. for a better understanding of how analytics work.  Essentially it's looking at a lot of different factors after the event to determine the larger picture.

By looking into the activity that caused the alert you may be able to find similarities you can use to create a high fidelity BIOC which can be used to block unwanted activity in your environment.

I hope you find this information helpful.  Have a great day!

[PiyushKohli]

Hi @Kyle_Begle 

Just to add while looking into the activity that caused the alert you can "Debug alert" to see the interesting fields which can be used for creating BIOC and then you can configure BIOC rules as custom prevention rules and incorporate them with your Restrictions profiles as shared above by @anlynch .
Screenshot for reference:

Ref: 
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Working-wit... 

Thanks