Decrypting and Abusing Predefined BIOCs in Palo Alto Cortex XDR - InfoGuard Labs

labs.infoguard.ch

Decrypting and Abusing Predefined BIOCs in Palo Alto Cortex XDR - InfoGuard Labs

labs.infoguard.ch

digicatM to

blueteamsecEnglish · 2 days ago

The Behavioral Indicators of Compromise (BIOCs) of Cortex XDR contain numerous exceptions, including global whitelists that can be abused to evade detection even when using simple and well-known TTPs.

You must log in or # to comment.

Chat

blueteamsec

Create a post

You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !blueteamsec@infosec.pub

For [Blue|Purple] Teams in Cyber Defence - covering discovery, detection, response, threat intelligence, malware, offensive tradecraft and tooling, deception, reverse engineering etc.

Visibility: Public

This community can be federated to other instances and be posted/commented in by their users.

13 users / day
64 users / week
307 users / month
950 users / 6 months
228 local subscribers
662 subscribers
2.74K Posts
213 Comments
Modlog

mods:
digicat