This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Cookie Policy. Click Preferences to customize your cookie settings.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- Discussions
- Security Operations
- Cortex XDR Discussions
- Who Me Too'd this topic
Who Me Too'd this topic
Options
- Mark as New
- Subscribe to RSS Feed
- Permalink
04-21-2022 04:13 PM
We know that Cortex has the ability to use AMSI but is any one able to achieve a BIOC rule which can trigger an alert for the content inside the script.
Lets say if a Powershell script which is being run has certain parameters in the body such as "replace","Download","Invoke-WebRequest" etc...
Is it possible to create a BIOC rule for the content inside in the script?
Thanks in Advance.
Kind Regards
KS
KS
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks