From 08e3f173659c4f7aaa13e8a4d94fb99d27deb3ba Mon Sep 17 00:00:00 2001 From: n00py Date: Tue, 11 Jun 2024 08:31:33 -0600 Subject: [PATCH 1/3] Update enum_av.py Added signature for Cortex Signed-off-by: n00py --- nxc/modules/enum_av.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/nxc/modules/enum_av.py b/nxc/modules/enum_av.py index 53f14667b..9ffe47f3b 100644 --- a/nxc/modules/enum_av.py +++ b/nxc/modules/enum_av.py @@ -247,6 +247,11 @@ def LsarLookupNames(self, dce, policyHandle, service): "services": [{"name": "CSFalconService", "description": "CrowdStrike Falcon Sensor Service"}], "pipes": [{"name": "CrowdStrike\\{*", "processes": ["CSFalconContainer.exe", "CSFalconService.exe"]}] }, + { + "name": "Cortex", + "services": [{"name": "xdrhealth", "description": "Cortex XDR Health Helper"}], + "services": [{"name": "cyserver", "description": " Cortex XDR"}], + }, { "name": "Cybereason", "services": [ From 15f29a9c4fff6efec9a623a1da67f8c31de16794 Mon Sep 17 00:00:00 2001 From: n00py Date: Tue, 11 Jun 2024 08:33:22 -0600 Subject: [PATCH 2/3] Update enum_av.py Signed-off-by: n00py --- nxc/modules/enum_av.py | 1 + 1 file changed, 1 insertion(+) diff --git a/nxc/modules/enum_av.py b/nxc/modules/enum_av.py index 9ffe47f3b..4400a8e35 100644 --- a/nxc/modules/enum_av.py +++ b/nxc/modules/enum_av.py @@ -251,6 +251,7 @@ def LsarLookupNames(self, dce, policyHandle, service): "name": "Cortex", "services": [{"name": "xdrhealth", "description": "Cortex XDR Health Helper"}], "services": [{"name": "cyserver", "description": " Cortex XDR"}], + "pipes": [] }, { "name": "Cybereason", From cdffba942dfec75054fcb424a4af94528a3171b2 Mon Sep 17 00:00:00 2001 From: n00py Date: Tue, 11 Jun 2024 08:35:36 -0600 Subject: [PATCH 3/3] Update enum_av.py Signed-off-by: n00py --- nxc/modules/enum_av.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/nxc/modules/enum_av.py b/nxc/modules/enum_av.py index 4400a8e35..d2854ffda 100644 --- a/nxc/modules/enum_av.py +++ b/nxc/modules/enum_av.py @@ -249,8 +249,10 @@ def LsarLookupNames(self, dce, policyHandle, service): }, { "name": "Cortex", - "services": [{"name": "xdrhealth", "description": "Cortex XDR Health Helper"}], - "services": [{"name": "cyserver", "description": " Cortex XDR"}], + "services": [ + {"name": "xdrhealth", "description": "Cortex XDR Health Helper"}, + {"name": "cyserver", "description": " Cortex XDR"} + ], "pipes": [] }, {