CVE-2023-36884 - Does Cortex XDR Pro cover this CVE?

[RFeyertag]

Hello dear LIVEcommunity!

Should we follow the recommendation from microsoft or does cortex xdr pro cover this CVE? 

https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-esp...

BR

Rob

[neelrohit]

Hi @RFeyertag ,

Thank you for writing to live community!

We have not yet found any internal updates on the same and would request you to open a support case for coverage assessments. We would be happy to hear from you in circumstance, you get any updates for the same.

Please feel free to mark the response as "Accept as Solution" if it answers your query

[neelrohit · Accepted solution]

Hi @RFeyertag ,

As per some latest updates, you can find updated information on coverage on our unit42 blog post:  https://unit42.paloaltonetworks.com/cve-2023-36884-rce/

hope this helps.

please mark the response as “Accept as Solution” if it answers your query so that others could navigate to this solution

[RFeyertag]

@neelrohit: Thank you very much!

BR

Rob

[RFeyertag]

There are no queries like mentioned in the blog post:

BR

Rob

[PiyushKohli]

Hi @RFeyertag 

Thanks for highlighting. Let me check and will update here on this.

Thank You

[micomi]

Hi @RFeyertag 

These are probably not the queries mentioned in the threat brief but Palo Alto released a XSOAR playbook. In this playbook you can find some XQL hunting queries.

https://cortex.marketplace.pan.dev/marketplace/details/CVE_2023_36884__Microsoft_Office_and_Windows_...

[RFeyertag]

Hello @micomi! 

I think one of these scripts needs some adjustment (the other Office Applications are missing too): 

Maybe you can forward it to the right people? 

BR

Rob

[micomi]

Hi  @RFeyertag 

Good point but I can't forward this to the right people. I'm not from Palo Alto but perhaps someone else can forward this topic

[bmelamed]

Hey,

We've released a fix for that XQL query. Will be available in the marketplace soon.

Ben