04-05-2023 01:25 AM
Hello all,
maybe i am to stupid but i have problems with understanding from the PAN-SA-2023-0002 Informational Bulletin: Impact of Rorschach Ransomware Article (https://security.paloaltonetworks.com/PAN-SA-2023-0002).
It's about:
„>= Agents with CU-240 or a later content update on Windows“
However, our content version is 910-49625
Furthermore, the FAQ also states the following:
"Q. Are Cortex XDR customers at risk for this ransomware?
Palo Alto Networks has verified that Cortex XDR 7.7, and newer versions, with content update version 240 (released November, 2021), and later content updates, detect and block the ransomware. A new content update will be released next week to detect and prevent the usage of this DLL side-loading technique."
So is the ransomware being detected and blocked now, but there won't be a Cortex XDR Dump Service Tool fix via content update until next week?
Sorry but i don't get it.
Maybe someone can help me with whis to understand.
BR
Sascha
04-05-2023 05:56 AM
I read the bulletin you provided @s.debus and your not crazy. It read to me like PAN needs to update the behavioral threat detection with an algorithm that Cortex 7.7 will use to detect the DLL side load activity Rorschach uses and an additional block in the kill chain to protect from modified versions using the Cortex XDR Dump Service Tool for the side load. That's what I get from the bulletin.
04-05-2023 05:56 AM
I read the bulletin you provided @s.debus and your not crazy. It read to me like PAN needs to update the behavioral threat detection with an algorithm that Cortex 7.7 will use to detect the DLL side load activity Rorschach uses and an additional block in the kill chain to protect from modified versions using the Cortex XDR Dump Service Tool for the side load. That's what I get from the bulletin.
04-05-2023 06:27 AM
Hi,
thank you for your response. Now it's clearer for me.
BR
Sascha
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!