As a Malware Analyst working with Cortex XDR you notice an alert suggesting that there was a prevented attempt to download Cobalt Strike on one of your servers. Days later, you learn about a massive o

Question

Options

• ACreate Behavioral Threat Protection (BTP) rules to recognize and prevent the activity.
• BEnable DLL Protection on all servers but there might be some false positives.
• CCreate IOCs of the malicious files you have found to prevent their execution.
• DEnable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.

• A
  76% (16)
• B
  14% (3)
• C
  5% (1)
• D
  5% (1)

Explanation

Behavioral Threat Protection (BTP) rules are designed to detect and block malicious behaviors rather than relying solely on known file signatures or IOCs. In a supply chain attack, the malicious activity often leverages legitimate binaries or trusted software (like the server software itself), making file-hash IOCs ineffective since the files may not be flagged as malicious. BTP rules capture the behavioral pattern of the attack (e.g., process injection, spawning of suspicious child processes, Cobalt Strike beacon activity) and can be deployed across all servers through a policy, providing broad protection. Option B (DLL Protection) is a general hardening measure but not targeted to this specific threat. Option C (creating IOCs) would help block known-bad files but fails if the attack uses trusted/signed components. Option D is incorrect because cytool is a local command-line agent management tool and cannot push a policy configuration to all servers from a central location.

No community discussion yet for this question.