MENU
An analyst wants to create a detection rule that triggers when any process attempts to perform code injection into the lsass.exe process, regardless of whether the file hash of the source process is known to be malicious. Which type of rule should be created?
In the Cortex XDR environment, rules are categorized by what they monitor:
BIOC (Behavioral Indicator of Compromise) (B): These rules are designed to detect behavioral patterns and techniques rather than specific files. In this scenario, the behavior is the injection into a sensitive system process (lsass.exe). Since attackers constantly change file hashes to evade signature-based detection, a BIOC rule is the most effective defense because it focuses on the 'action' (the 'how') which is much harder for an attacker to change.
IOC (Indicator of Compromise) (A): These are based on static artifacts like specific file hashes, IP addresses, or domain names. If the hash is unknown, an IOC rule would not trigger.
Analytics Alert (D): These are generated automatically by the platform's Machine Learning engine when activity deviates from a baseline. While it might catch this, it is not a 'manually created rule' by an analyst for a specific known-bad behavior.
Currently there are no comments in this discussion, be the first to comment!