Cortex XDR - Impact of Rorschach Ransomware - Problem with understanding

[s.debus]

Hello all,

maybe i am to stupid but i have problems with understanding from the  PAN-SA-2023-0002 Informational Bulletin: Impact of Rorschach Ransomware Article (https://security.paloaltonetworks.com/PAN-SA-2023-0002).

It's about:

„>= Agents with CU-240 or a later content update on Windows“

However, our content version is 910-49625

Furthermore, the FAQ also states the following:

"Q. Are Cortex XDR customers at risk for this ransomware?
Palo Alto Networks has verified that Cortex XDR 7.7, and newer versions, with content update version 240 (released November, 2021), and later content updates, detect and block the ransomware. A new content update will be released next week to detect and prevent the usage of this DLL side-loading technique."

So is the ransomware being detected and blocked now, but there won't be a Cortex XDR Dump Service Tool fix via content update until next week?

Sorry but i don't get it.

Maybe someone can help me with whis to understand.

BR

Sascha

 

[delliott_6784 · Accepted solution]

I read the bulletin you provided @s.debus and your not crazy.  It read to me like PAN needs to update the behavioral threat detection with an algorithm that Cortex 7.7 will use to detect the DLL side load activity Rorschach uses and an additional block in the kill chain to protect from modified versions using the Cortex XDR Dump Service Tool for the side load.    That's what I get from the bulletin.

[s.debus]

Hi,

thank you for your response. Now it's clearer for me.

BR

Sascha