cortex XDR add SHA1 detection

[frank.f.lu]

Does anyone know a way to detect for SHA1 on Cortex XDR?

Regarding IOC, it can't add SHA1 into hash type.

Regarding BIOC, for xdr_data, there is no columns to determine the SHA1 for a file or process:

 Any ideas?

[nsinghvirk · Accepted solution]

Hello @frank.f.lu 

Thanks for reaching out on LiveCommunity!

Unfortunately SHA1 is not supported by Cortex XDR because Wildfire only support MD5 and SHA256 as hash types. Hence XDR can only provide verdict for MD5 and SHA256 hash types only.