topic Cortex XDR and windows Install folder in Cortex XDR Discussions

Cortex XDR and windows Install folder

LukasB — Wed, 16 Feb 2022 14:48:50 GMT

Hello,

we started to have Cortex XDR alerts for *.tmp files, which refer to the C:\Windows\Install folder.

e.g. C:\Windows\Installer\MSI53B1.tmp

Wildfire report says its Malware based probably on the:

Attempted to sleep for a long period | Medium Malware analysis environments have a limited amount of time in which to execute code and deliver a verdict. To subvert this process, malware often delays execution, or "sleeps," for a long period, allowing it to avoid detection. Created or modified a file in the Windows system folder | Medium The Windows system folder contains configuration files and executables that control the underlying functions of the system. Malware often modifies the contents of this folder to manipulate the system, establish persistence, and avoid detection.

Interesting thing is that this folder does not exists on any of reported machines, incl. hidden folders.
Can anyone explain me a little bit more what is the folder \Install for and why we cannot see it?
Does windows cleans after some patch update / bundle update, but this stays in memmory and Cortex Agent is able to dig it out?

I can report it as an incorrect verdict, but firstly would like to know..

Thank you.
Lukas

Thank you.

Re: Cortex XDR and windows Install folder

jcandelaria — Wed, 16 Feb 2022 16:35:22 GMT

Hi LukasB,

Typically during an application install, it will create tmp file just like what you see, then after the install, it will clean those temp files that's why its gone. During that time of install execution, XDR will do its checking, thats the reason why you see those alerts.

Re: Cortex XDR and windows Install folder

LukasB — Thu, 17 Feb 2022 09:00:56 GMT

That's exactly what I thought.... what is the best practice? Exclude the folder from malware scan or... ? creating an exception can be potentially dangerous

Re: Cortex XDR and windows Install folder

bbarmanroy — Fri, 18 Feb 2022 02:14:41 GMT

@LukasB Mark the incident as Resolved - False Positive since you're aware this is the case. There is no need to exclude any folder from Malware scans as you correctly stated - malicious actors can use temporary directories for staging and short-lived persistence.

Furthermore, XDR Agents will monitor all running processes, raise alerts, perform detection/blocking actions and/or create incidents , whether or not the corresponding files were scanned in disk, and will flag accordingly upon execution.