topic Re: Excluding files from local malware analysis scan in Cortex XDR Discussions

Excluding files from local malware analysis scan

Daniel_Itenberg — Sun, 03 Apr 2022 07:11:05 GMT

Hi all,

I have a specific file that i would like to whitelist. I have it in the allow list(by hash) but it still sometimes blocked by the "local analysis malware" due to having a different hash than the one in the allow list.

Is there a way to exclude a file from the scan via name, or any other way?

Re: Excluding files from local malware analysis scan

eluis — Sun, 03 Apr 2022 14:55:35 GMT

Hi @Daniel_Itenberg ,

have you thought of adding the signer as a trusted signer ? this will not take into account the hash. This is useful also for drivers from specific vendors that sign their software.

Please check this doc on how to do it at the malware profile:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/endpoint-security-profiles/add-malware-security-profile.html

I wont recommend much to add a whole folder to the allow list since malicious actors might drop their malware there and go undetected.

If hash and trusted signer do not work either of them, open a TAC support case to get a suex.
Hope this helps

KR,

Luis

Re: Excluding files from local malware analysis scan

Daniel_Itenberg — Mon, 04 Apr 2022 09:11:42 GMT

What if the signature filed says "invalid signature"?

Re: Excluding files from local malware analysis scan

eluis — Mon, 04 Apr 2022 10:10:26 GMT

Hi @Daniel_Itenberg ,

I would open a TAC support case to see what is the issue here. Our TAC engineers will provide you help on this

KR,

Luis

Re: Excluding files from local malware analysis scan

MartinPfeil — Mon, 04 Apr 2022 14:36:50 GMT

If the file is always in the same location you can create a malware profile and exclude this location from scanning.

That is the easiest solution, as chaning hashes will invalidate the entires in the allow list

Re: Excluding files from local malware analysis scan

Anil_Racharla — Thu, 25 Aug 2022 05:42:16 GMT

Hii Eluis,
How to add a trusted signer .
How to sign a application which is internal built for organisation