About tech_noob

tech_noob · ‎09-17-2020

Here is a very good video on how Cortex XDR is used as TTP. Optimize SecOps Investigation and Response to Stop Sophisticated Attacks with Cortex XDR and XSOAR https://www.youtube.com/watch?v=3ZAeF2MiSwY

tech_noob · ‎09-17-2020

I a spare PA220 that I can use to test this configuration before putting on Panorama. Thank you!

tech_noob · ‎09-17-2020

Yes, Symantec detected it and stopped it on the endpoint. We upgraded our Cortex to Pro and I will test again under Cortex Pro maybe it will detect it as BIOC on the endpoint. I will post the result.

tech_noob · ‎09-15-2020

I am new to Palo Alto NGFW and Cortex, does anybody have any special TTP they want to share to noobs like me?

tech_noob · ‎09-15-2020

I run windows defender along with cortex xdr. I have tamper protection on cortex xdr.

tech_noob · ‎09-15-2020

ncat is a legitmate software but it can be used maliciouisly by bad guys. Kali is a network penetration software that is used by white and black hat hackers. I ran ncat on my windows machine and I connected with ncat from my Kali machine. I used ncat (without e) by nmap because the actual netcat (with e) is blocked by windows defender and cortex. We upgraded to Cortex XDR pro and I should be able to create BIOC rules to give me alert when ncat is used in my network.

tech_noob · ‎08-22-2020

Hello I am new to Cortex XDR. I tried ncat on a PC with Cortex XDR Prevent (with Windows Defender) and it did not detect or stop the connection from Kali a PC. Windows Defender showed a warning and once I allowed it I was able to connect on ncat from Kali. Is Cortex XDR Prevent supposed to stop ncat or at least give me an email alert about the connection? Anybody else tried this and with the same result? I will try this with Symantec and will see if Symantec stops the ncat connection. Thank you

tech_noob · ‎08-17-2020

I am using XDR prevent currently. My vendor made an error we are supposed to get pro and I am waiting for the upgrade in the next week or so.

tech_noob · ‎08-13-2020

Hello, I am new to Cortex XDR, I just installed it. I tried nbns spoofing on a pc with Cortex XDR and it did not stop or detect it. My previous test with Symantec was detected and stopped. Any thoughts on this?

Member Since	‎11-02-2017 07:41 PM
Date Last Visited	‎10-09-2020 09:52 PM
Posts	9
Total Likes Received	5

Online Status	Offline
Date Last Visited	‎10-09-2020 09:52 PM

About tech_noob

Re: Tactics Technique and Procedure (TTP) for Noob Threat Hunting

Re: Tactics Technique and Procedure (TTP) for Noob Threat Hunting

Re: Cortex XDR unable to detect nbns spoofing using kali linux responder

Tactics Technique and Procedure (TTP) for Noob Threat Hunting

Re: Cortex XDR Prevent Did Not Detect ncat

Re: Cortex XDR unable to detect nbns spoofing using kali linux responder

Cortex XDR unable to detect nbns spoofing using kali linux responder

Cortex XDR Prevent Did Not Detect ncat

Re: Cortex XDR Prevent Did Not Detect ncat

Re: Cortex XDR Prevent Did Not Detect ncat

Cortex XDR folder exclusion

Re: Tactics Technique and Procedure (TTP) for Noob Threat Hunting

Re: Tactics Technique and Procedure (TTP) for Noob Threat Hunting

Re: Cortex XDR unable to detect nbns spoofing using kali linux responder

Tactics Technique and Procedure (TTP) for Noob Threat Hunting

Re: Cortex XDR Prevent Did Not Detect ncat

Re: Cortex XDR Prevent Did Not Detect ncat

Cortex XDR Prevent Did Not Detect ncat

Re: Cortex XDR unable to detect nbns spoofing using kali linux responder

Cortex XDR unable to detect nbns spoofing using kali linux responder

Network Security

Cloud Security

Security Operations

About tech_noob