topic Cortex XDR has Blocked a Malicious Activity but No Program Listed in Cortex XDR Discussions

Cortex XDR has Blocked a Malicious Activity but No Program Listed

mixzawa — Tue, 10 May 2022 17:08:50 GMT

Attached images show the pop-up that is going around our network this morning. Unlike before where it would list the program Cortex blocks there is nothing there and is pointing at Microsoft for the cause.

Is this a false positive? A windows service is triggering Cortex to block the behavioral threat?

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

mdb1998 — Tue, 10 May 2022 17:25:52 GMT

We're getting the same type alert this morning on all our endpoints. We haven't determined what is causing it though.

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

KMcKenna — Tue, 10 May 2022 17:42:20 GMT

We are seeing Cortex Behavioral Threat High Blocks related to Microsoft. Pretty much all end points. smss.exe .. a MSFT signed file is identified. Unclear what is the precise cause.

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

mixzawa — Tue, 10 May 2022 17:46:08 GMT

Minor update my home office PC (Windows 100 Pro) now got the notification from XDR while at work we use Windows 10 Pro. Can never have a quiet day off can I? 😛

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

arvesynd — Tue, 10 May 2022 18:09:46 GMT

Hi,

We're seeing the same here as well. End users are shown no application name, but digging through the incidents in the console shows that it's killing of Smss.exe, which is the System Center Configuration Manager agent.

All endpoints generating alerts are running 7.7.0.60725 here.

Looking through the timeline there seems to be no evidence of foul play.

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

KMcKenna — Tue, 10 May 2022 18:12:30 GMT

We are on 7.7.0 as well.

Thanks for the comment

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

arvesynd — Tue, 10 May 2022 18:14:27 GMT

This alert just trigged on my personal device when updating to content version 500-90199.
Sooo... rollback, please?

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

KMcKenna — Tue, 10 May 2022 18:20:09 GMT

We have a Support ticket opened (High Severity) and also are working with an inside (Palo) engineer associated with our Sales team. So hopefully we will learn more soon.

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

arvesynd — Tue, 10 May 2022 18:48:05 GMT

@KMcKenna Please let us know if they provide a workaround or a fix for the issue.

Fingers crossed the update either get fixed or pulled tonight, so I won't have to deal with this when each endpoint boots tomorrow.

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

KMcKenna — Tue, 10 May 2022 18:52:16 GMT

Yes, absolutely.

For reference, if anyone else opens a case, our Case # is 02191931.

The rule triggering the alert is:

Behavioral threat detected (rule: other.malware_gen_task.105)

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

adminBandE — Tue, 10 May 2022 19:01:21 GMT

Getting this too. It occurs after the latest content & policy update. I can manually trigger it but clicking check-in now button, so its like the process that applies the policy update is triggering itself lol.

You can verify this in the endpoint log on portal, it triggers same time as the policy

update.

Support case logged also:

CASE #: 02191983

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

KMcKenna — Tue, 10 May 2022 19:21:24 GMT

@adminBandE I also clicked Check In Now on a completely isolated host (off site). Had same response as you in that the Alert triggered.

Will add that to our support case. Thanks

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

adminBandE — Tue, 10 May 2022 19:34:35 GMT

Update from my Case:

From the case description, I understand that you are receiving BTP alerts for smss.exe for the rule other.malware_gen_task.105
I would like to inform you that it is a false positive BTP alert and multiple customers where reported the same. We are working on the fix and will update you as soon as available.
As a workaround please create an alert exception for now reference.

I just created the (temporary) exception, lets see if it takes effect!

Edit: It does work. Apply the alert exception from the incident under alerts & insights, right-click the alert and select manage alert - create alert exception. It will then appear under your global BTP rules.

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

mixzawa — Tue, 10 May 2022 19:33:35 GMT

Hoping for all of us as user calls about will get very old very fast.

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

KMcKenna — Tue, 10 May 2022 19:39:09 GMT

We are being told this is a False Positive and the Palo Support team is working on it. They say to create an exclusion in the meantime. Some general info on doing that...

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/exceptions-security-profiles/add-exceptions-profile

This is a general Docs page. So if you are not familiar with doing this, you may need more info. This is linked info not specific to this alert.

That's all I have at the moment.

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

KPaschall — Tue, 10 May 2022 21:23:51 GMT

Has there been any resolution yet? We are experiencing the same...

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

KMcKenna — Tue, 10 May 2022 21:36:23 GMT

@KPaschall No specific fix other than Palo Alto has confirmed it is a False Positive and they are working on a solution.

In the meantime they suggested creating an exception. However, when I created a Global Process Exception using 'smss.exe' as the process, we saw an alert about 7 or 8 minutes later on a remote laptop. So I am not sure if this exception is properly excluding what it needs to exclude. As far as I can see in the alerts/incidents in the GUI.. there is no specific named 'process'. Just the file. So it might be working correctly, but I can't say for sure.

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

KMcKenna — Tue, 10 May 2022 21:41:58 GMT

I also have this information to add from Palo Alto Networks support.... as of 5:30 PM US Eastern Daylight Time

----

- Content Update 510, will provide a fix [in] approximately 1 hour
- Content Update 500, will provide a fix [in] approximately 12 hours

As a workaround please create an alert exception for now reference

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/exceptions-security-profiles/add-exceptions-profile

To do this,

1. Go to Incident Response > Incidents.
2. Right-click on the Behvaioral Threat Incident then click View Incident.
3. Under Alerts & Insights, look for the Behavior threat alert for the process.
4. Right-click on the alert then click Create alert exception.
5. Select the Exception Scope. You can assign it to a specific profile or set it to Global, then click Add.

Once the fix is out, you can then remove the exception.

---

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

KMcKenna — Tue, 10 May 2022 21:47:44 GMT

One issue, as I mentioned previously, is that the process is not specifically named in the incident as far as I can see. Only the file name of smss.exe. So that file name is what I used as a process name. Unclear if that is working since we did see one more alert 7 or 8 minutes after creating the Process Exception.

Re: Cortex XDR has Blocked a Malicious Activity but No Program Listed

KMcKenna — Wed, 11 May 2022 14:34:38 GMT

An update from Palo Alto.. content version 510-90618 has been released and should address the issue.

-K