About RonaldWeiss

Hi, this feature will have a on/off switch in the 3.10 release.   ... View more

Same here...   ... View more

So, nevertheless the install_date as string is hard to filter by date. To resolve this, parse_timestamp might be a solution, but i dont get how it works... The install_date string is "2022-08-11" which i'd like to convert to something filterable like "Aug 11th 2022".     ... View more

Perhaps this might be what you want:   config case_sensitive = false | dataset = host_inventory | arrayexpand kbs | alter kbnr = json_extract(kbs , "$.name"), install_date = json_extract(kbs , "$.installation_date") | fields host_name, kbnr , install_date |dedup host_name by desc install_date | sort asc install_date     and after that, perhaps a "|limit 50" ... View more

Hi, this might work. But if there is a deb package provided, it should work as expected, and not unveil as a renamed tar.gz. When you follow the part "To deploy using package manager" on your screenshot, this simply doesnt work. AND: the deb was working since 7.6!   To clarify: i AM able to install a tar.gz, but there is the fact that the deb installer is not working as expected. So i think someone messed something up. The Intention of the post is to inform about the failing installer.   PA should either change the manual below "To deploy using package manager" (add "unpack the *.deb using tar -xfz, and copy the config file"), and get the laughts of every linux-admin, or just fix the creation of the deb file. ... View more

Hello, as Luc mentioned here (https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/m-p/496106/highlight/true#M2073 ) the use of custom prevention rules  with the BIOC works lika a charm here. So, this will be my solution until PA or Microsoft deliver a proper one. (Which, for PA, might be a BIOC, too 😉 ) ... View more

Hi @Luc_Desaulniers , thanks for the hint with the custom prevention rules. i really didnt think of that 🙂 works like a charm! ... View more

FYI, some IOCs for this CVE, which might help: New Microsoft Office Attack Vector via ms-msdt Protocol Scheme (CVE-2022-30190) - SANS Internet Storm Center - AlienVault - Open Threat Exchange At least the initial malicious document is already recognized by Cortex/Wildfire:  4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784   ... View more

Thats true. That is why i first searched for all occuring msdt.exe and added all hashes 😉   As far as i see, disabling diagnistics doesn't seem to help here, as the binary is still there and handling urls. The only "real" workaround, afaik, is to disable msdt url protocol, as stated by microsoft. BUT you will have to do registry changes everwhere, and revert (if needed) later. So, blocking the hashes in the meantime, until a patch is available, seemes to be the less invasive way to go...   ... View more

@MartinPfeil : good idea, well done query. but you cannot prevent with it.  That's the reason i'd love to see a hashblock for msdt.exe... ... View more

Hello, hope it's ok to attach mine, as it is the same issue/idea... If this would work, your issue would be resolved as well: https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/cortex-does-not-block-windows-binaries/td-p/495153 ... View more

Hi, Yeah, i have read that, too. BUT: In that guide it says: Ubuntu or Debian apt-get install ./filename.deb or dpkg -i ./filename.deb But that doesn't work because the package provided is NOT a deb package, but a tar.gz with the wrong file extension!   #file 2022_05_30_Cortex_XDR_Linux_7_7_1_62043.deb 2022_05_30_Cortex_XDR_Linux_7_7_1_62043.deb: gzip compressed data, was "traps_linux-7.7.1.61152_deb.tar", last modified: Mon May 30 08:29:27 2022, max compression, original size 55715840   Why not just include the tennant ID and reg-key into the deb package? btw: i could do that myself, but thats not my job... ... View more

Hi, I already createt a ticket for this to our MSSP. Nevertheless hoped to speed up, or get Information, here... i also assume it's backend issue during creation of the installer package. ... View more