decioMar 3

Tiens, jolie démo et trouvaille!

l'équipe redteam d' Infoguard 🫕 a décortiqué le système de communication pour la prise de contrôle à distance de l'EDR de Palo Cortex pour la détourner en mode Living-off-the-Land
👇
https://labs.infoguard.ch/posts/abusing_cortex_xdr_live_response_as_c2/

.
.
.
.
The only hurdle is that Cortex has default rules to block and detect when its own processes are started by a non-standard parent process
Bypasses for these rules will not be published in this post. 😈 😢

#CyberVeille #CortexXDR

Abusing Cortex XDR Live Terminal as a C2 - InfoGuard Labs

The Cortex XDR agent includes an incident response feature called "Live Terminal", which attackers can abuse as a C2.

InfoGuard Labs
Show thread decio

nice

"Identifying the algorithm, key, and IV was relatively straightforward with assistance from an LLM."

A hardcoded string is present in the binary, but only a portion of it is used as the key (maybe this is supposed to be a obfuscation technique):   
👇
https://labs.infoguard.ch/posts/decrypting-and-abusing_paloalto-cortex-xdr_behavioral-rules_biocs/

#cortexxdr #cyberveille

Decrypting and Abusing Predefined BIOCs in Palo Alto Cortex XDR - InfoGuard Labs

The Behavioral Indicators of Compromise (BIOCs) of Cortex XDR contain numerous exceptions, including global whitelists that can be abused to evade detection even when using simple and well-known TTPs.

InfoGuard Labs
Mar 16 at 11:18amWeb