Merge pull request #344 from n00py/main

Add EnumAV Detection for Cortex XDR
Pennyw0rth · Jun 14, 2024 · 1af2828 · 1af2828
2 parents f2311b3 + cdffba9
commit 1af2828
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/nxc/modules/enum_av.py b/nxc/modules/enum_av.py
@@ -247,6 +247,14 @@ def LsarLookupNames(self, dce, policyHandle, service):
             "services": [{"name": "CSFalconService", "description": "CrowdStrike Falcon Sensor Service"}],
             "pipes": [{"name": "CrowdStrike\\{*", "processes": ["CSFalconContainer.exe", "CSFalconService.exe"]}]
         },
+        {
+            "name": "Cortex",
+            "services": [
+                {"name": "xdrhealth", "description": "Cortex XDR Health Helper"},
+                {"name": "cyserver", "description": " Cortex XDR"}
+            ],
+            "pipes": []
+        },
         {
             "name": "Cybereason",
             "services": [