RDPStealer Does Cortex XDR Pro cover this ?

[tlmarques]

Hello dear LIVEcommunity!

someone know if Cortex XDR pro cover this attack?

RDPStrealer is a stealer that allows attackers to obtain the user's login credentials when trying to contact other machines, thus ensuring their persistence on the network by stealth.

Unpacking RDStealer: An Exfiltration Malware Targeting RDP Workloads (bitdefender.co.uk)

New 'RDStealer' Malware Targets RDP Connections - SecurityWeek

Researchers uncover novel RDStealer malware targeting remote desktop protocol | ITPro

[afurze · Accepted solution]

Hi Tlmarques,

For coverage assessment requests, please open a TAC case.

[tlmarques]

Hi, we currently don't have any issues in our company. However, I would like to know if Cortex XDR provides protections against that specific attack.

Usually, when I open a case, the support team requests logs...and we don't have them for this situation. It's only a question about protections, etc.... but alright, I will ask TAC.

Thnks

[afurze · Accepted solution]

When you submit a coverage assessment request, TAC takes it to our research team, they know there are no logs to request.

[tlmarques]

TAC response:

From the key factors, the RDStealer could use:
- DLL hijacking 
- Credential dumping
- The process msql/lsass 

All is covered by Cortex