PCDRA · Question #37
As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to open a malicious Word document. You learn from the WildFire report and AutoFocus that
The correct answer is B. Create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.. The correct answer is B, create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity. BTP rules are a powerful feature of Cortex XDR that allow you to define custom rules to detect and block malicious behaviors on endpoints. You can use BTP rules to crea
Question
As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to open a malicious Word document. You learn from the WildFire report and AutoFocus that this document is known to have been used in Phishing campaigns since 2018. What steps can you take to ensure that the same document is not opened by other users in your organization protected by the Cortex XDR agent?
Options
- AEnable DLL Protection on all endpoints but there might be some false positives.
- BCreate Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
- CNo step is required because Cortex shares IOCs with our fellow Cyber Threat Alliance members.
- DNo step is required because the malicious document is already stopped.
How the community answered
(32 responses)- A9% (3)
- B81% (26)
- C3% (1)
- D6% (2)
Explanation
The correct answer is B, create Behavioral Threat Protection (BTP) rules to recognize and prevent the activity. BTP rules are a powerful feature of Cortex XDR that allow you to define custom rules to detect and block malicious behaviors on endpoints. You can use BTP rules to create indicators of compromise (IOCs) based on file attributes, registry keys, processes, network connections, and other criteria. By creating BTP rules, you can prevent the same malicious Word document from being opened by other users in your organization, even if the document has a different name or hash value. BTP rules are updated through content updates and can be managed from the Cortex XDR console.
Topics
Community Discussion
No community discussion yet for this question.