XDR-ANALYST · Question #83
Cortex XDR is deployed in the enterprise and you notice a cobalt strike attack via an ongoing supply chain compromise was prevented on 1 server. What steps can you take to ensure the same protection…
The correct answer is D. Create lOCs of the malicious files you have found to prevent their execution. The best step to ensure the same protection is extended to all your servers is to create indicators of compromise (IOCs) of the malicious files you have found to prevent their execution. IOCs are pieces of information that indicate a potential threat or compromise on an…
Question
Cortex XDR is deployed in the enterprise and you notice a cobalt strike attack via an ongoing supply chain compromise was prevented on 1 server. What steps can you take to ensure the same protection is extended to all your servers?
Options
- AConduct a thorough Endpoint Malware scan.
- BEnable DLL Protection on all servers but there might be some false positives.
- CEnable Behavioral Threat Protection (BTP) with cytool to prevent the attack from spreading.
- DCreate lOCs of the malicious files you have found to prevent their execution.
How the community answered
(27 responses)- A7% (2)
- B4% (1)
- C15% (4)
- D74% (20)
Explanation
The best step to ensure the same protection is extended to all your servers is to create indicators of compromise (IOCs) of the malicious files you have found to prevent their execution. IOCs are pieces of information that indicate a potential threat or compromise on an endpoint, such as file hashes, IP addresses, domain names, or registry keys. You can create IOCs in Cortex XDR to block or alert on any file or network activity that matches the IOCs. By creating IOCs of the malicious files involved in the cobalt strike attack, you can prevent them from running or spreading on any of your servers.
Topics
Community Discussion
No community discussion yet for this question.