SD-card Block

akash_totia — Thu, 12 May 2022 22:43:17 GMT

How to block execution from an SD-card by leveraging a restriction profile?

Re: SD-card Block

bbarmanroy — Fri, 13 May 2022 02:08:56 GMT

Hi @akash_totia you can consider using Device Control to block portable media devices.

Please refer to the link, and follow the steps in sequence. At a high-level, this is a two-step process:

Step1: Identify the Device GUID. As per the documentation here, the GUID should fall under the class of Memory Technology Driver. Add it as a custom device in Endpoints -> Policy Management -> Device Management.

Step 2: Add a new Extensions Profile and choose the custom class that you created, and set the Action to Block. Apply the profile to your endpoints.

Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/hardened-endpoint-security/device-control

Re: SD-card Block

akash_totia — Sun, 15 May 2022 23:39:05 GMT

Thanks, @bbarmanroy works perfectly 🙂

Re: SD-card Block

GhostFly — Mon, 16 May 2022 09:05:36 GMT

Thank you for the explanation. It is clear for me.

official website

topic SD-card Block in Cortex XDR Discussions

SD-card Block

Re: SD-card Block

Re: SD-card Block

Re: SD-card Block