WMIC MDE exclusions

[RFeyertag]

Hello dear community, 

do we need to setup our own bioc, or will this come as a standard rule from PA?

https://twitter.com/malmoeb/status/1671453836605550592

BR

Rob

[anlynch · Accepted solution]

Hi @RFeyertag,

Thanks for reaching out.

This is a really interesting thread and thanks for sharing with the community.  When I first saw this question I wasn't 100% sure if Cortex XDR would protect this out of the box.  This definitely looks like a novel technique to me.  I wasn't even sure you could use WMIC in that way.

With that being said I decided I need to test to find the answer to your question.  I am happy to report that Cortex XDR detected and blocked the action.  Please see the shots below.

Thanks for sharing this with the community and I hope you find this information helpful!

Have a great day!

[RFeyertag]

Hello @anlynch! 

thank you so much for giving us this result from your test!!

BR

Rob