Cortex XDR Prevent Did Not Detect ncat

Reply
Highlighted
L1 Bithead

Cortex XDR Prevent Did Not Detect ncat

Hello I am new to Cortex XDR. I tried ncat on a PC with Cortex XDR Prevent (with Windows Defender) and it did not detect or stop the connection from Kali a PC. Windows Defender showed a warning and once I allowed it I was able to connect on ncat from Kali. Is Cortex XDR Prevent supposed to stop ncat or at least give me an email alert about the connection? Anybody else tried this and with the same result? I will try this with Symantec and will see if Symantec stops the ncat connection. 

 

Thank you 

 

Highlighted
L2 Linker

Consider two things:

 

1. Windows Defender should be disabled on PC that runs Cortex XDR. If this does not occur automatically, disable it manually as it could intervene with Cortex XDR.

 

2. In case Cortex XDR does not indeed prevent it by default, you can always create a BIOC rule to detect NCAT and then set it as prevention rule inside the Restrictions Profile -> Custom Prevention Rules.

 

Best,

David

Highlighted
L2 Linker

@DKasabji, I am seeing some devices where Windows Defender Antivirus still have the service running.  I disable it via GPO and surprised to see it running on my system.  With the new tamper protections I have yet to figure out how to disable the service so it is like it is "off" but still running the app behind the scenes.  We are not Intune subscribers so there does not appear to be a way to turn it off if Cortex fails to do so.

Highlighted
L2 Linker

@tech_noob, doesn't ncat have legtimate uses so in and of itself it is not evil?  Do you have the grayware protection enabled? (Just thinking out loud...I am not experienced with Kali or ncat.

Highlighted
L2 Linker

@EddieRowe Aren't you able to disable Tamper protection on Windows? That way you can disable Defender via GPO. 

 

Highlighted
L1 Bithead

ncat is a legitmate software but it can be used maliciouisly by bad guys. Kali is a network penetration software that is used by white and black hat hackers. I ran ncat on my windows machine and I connected with ncat from my Kali machine. I used ncat  (without e) by nmap because the actual netcat (with e) is blocked by windows defender and cortex. We upgraded to Cortex XDR pro and I should be able to create BIOC rules to give me alert when ncat is used in my network.  

Highlighted
L1 Bithead

I run windows defender along with cortex xdr. I have tamper protection on cortex xdr. 

Highlighted
L2 Linker

@DKasabji, No it cannot be disabled any longer unless you have an Intune subscription per MS documentation (link below).  Our GPO has had Windows Defender turned off for many years now going back to before we added Cortex XDR Prevent to our environment.  (The prior solution did not disable automatically so we have always used the GPO setting.)  The GPO setting is active and Defender has never been observed doing anything on our systems to my knowledge.  But for some reason some systems, all running Win10 v1903, some systems have the Windows Defender Antivirus Service running and others do not.  I am going to guess that this was an issue before Cortex XDR Prevent and it was just not noticed.  We have an application misbehaving and the vendor claims Windows Defender is the cause so as part of my info gathering I noticed the service running on the system.

 

https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/pre...

 

 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!