Cortex XDR capabilities to detect phishing attacks

[A.BELKAHLA]

Hello everyone,

Im new to Cortex XDR, can someone please tell me if there is BIOC rules or analytic rules to detect advanced phinshing attacks as AiTM,  BEC, and more...

Best regard,

[susekar]

Hello @A.BELKAHLA ,

Greetings for the day.

Cortex XDR employs a multi-layered detection strategy to identify advanced phishing attacks, including Business Email Compromise (BEC) and Adversary-in-the-Middle (AiTM) techniques. These detections are primarily handled through a combination of Behavioral Indicators of Compromise (BIOCs), Analytics BIOCs (ABIOCs), and XDR Analytics rules.

Cortex XDR uses different rule types to detect various stages of an attack:

• XDR Analytics Rules: Use machine learning and behavioral analytics to identify complex attacks by analyzing data over time and detecting deviations from normal behavior. These rules are particularly effective for detecting BEC by identifying anomalous user activities, such as suspicious logins or unusual mailbox access.
  
  
• Analytics BIOCs (ABIOCs): Detect individual events that significantly deviate from the established behavioral baseline within your environment. For example, they can trigger when an administrator performs an action that has not been observed for an extended period.
  
  
• Standard BIOCs: Monitor specific sequences of endpoint activity, including file, process, registry, and network events, to identify malicious behavior.

For more information's or clarification on this, Please reach out to your Accounts team/PS team.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar