XDR - portproxy enabled allow a man-in-the-middle attack

[tlmarques]

Hi

Does anyone know if Cortex XDR detect and/or protect against this type of attack:

Windows 10 must not have portproxy enabled or in use (syxsense.com)

[jmazzeo · Accepted solution]

Hi @tlmarques, thanks for reaching us using the Live Community.

I did a test in my lab by modifying the registry as mentioned in the link, and it was not detected by the XDR Agent as malicious.

In this cases you can create custom BIOCs to detect this behaviors that might not be malicious by themselves.

I have created this custom BIOC rule that you can apply in Detection Rules - BIOC - Add Bioc to detect modifications to this registry key.

dataset = xdr_data 
| filter event_type = ENUM.REGISTRY and event_sub_type = ENUM.REGISTRY_CREATE_KEY 
| filter action_registry_key_name contains  """HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Services\\PortProxy\\"""

 Tested and working as expected:

You can even add the BIOC to a Restriction Profile and block the process doing the registry modification.

If this post answers your question, please mark it as the solution.