Cortex XDR Analytics can alert when detecting activity matching the following MITRE ATT&CKTM techniques.

Cortex XDR Analytics is a feature of Cortex XDR that leverages machine learning and behavioral

analytics to detect and alert on malicious activity across the network and endpoint layers. Cortex XDR

Analytics can alert when detecting activity matching the following MITRE ATT&CKTM techniques:

Exfiltration, Command and Control, Lateral Movement, Execution, Persistence, Privilege Escalation,

Defense Evasion, Credential Access, Discovery, and Collection. However, among the options given in

the question, the correct answer is D, Exfiltration, Command and Control, Lateral Movement. These

are three of the most critical techniques that indicate an advanced and persistent threat (APT) in the

environment. Exfiltration refers to the technique of transferring data or information from the

compromised system or network to an external location controlled by the adversary. Command and

Control refers to the technique of communicating with the compromised system or network to

provide instructions, receive data, or update malware. Lateral Movement refers to the technique of

moving from one system or network to another within the same environment, usually to gain access

to more resources or data. Cortex XDR Analytics can alert on these techniques by analyzing various

data sources, such as network traffic, firewall logs, endpoint events, and threat intelligence, and

applying behavioral models, anomaly detection, and correlation rules. Cortex XDR Analytics can also

map the alerts to the corresponding MITRE ATT&CKTM techniques and provide additional context

and visibility into the attack chain1234

Reference:

Cortex XDR Analytics

MITRE ATT&CKTM

Cortex XDR Analytics MITRE ATT&CKTM Techniques

Cortex XDR Analytics Alert Categories