topic Re: Cortex XDR Delete Malware in Cortex XDR Discussions

Cortex XDR Delete Malware

PKhemarith — Sat, 18 Jul 2020 04:30:06 GMT

Hello

i see alert malware in incident report . how i can delete malware from Cortex XDR admin portal.

Agent version 7.0.2

Re: Cortex XDR Delete Malware

SimonTan — Tue, 21 Jul 2020 21:35:25 GMT

i have a similar question,

how does cortex deals with malware? does tech support have to take another antivirus to scan and clean the infected endpoint computer?

Re: Cortex XDR Delete Malware

KRisselada — Tue, 21 Jul 2020 22:35:12 GMT

hello @PKhemarith perhaps I am not understanding your question or task requirement, but is this what is being asked?

"Retrive Files from an Endpoint"
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/investigate-endpoints/retrieve-files-from-an-endpoint.html#idaedd753c-d76f-42a7-a381-ebdad39e16b2

I found the above in the Cortex XDR Pro Administrators Guide

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin.html

Re: Cortex XDR Delete Malware

dfalcon — Tue, 21 Jul 2020 23:31:07 GMT

Hi there-

Assuming you have quarantine malware enabled in your malware profile, no action is needed on your part. If enabled, the agent will quarantine the file which means that it will encrypt the file and move it to a location that is inaccessible (left there in case it needs to be restored.) The agent will delete the malware itself based on the quota settings specified in the agent profile.

Hope this helps.

Re: Cortex XDR Delete Malware

Balaraju — Fri, 18 Feb 2022 16:54:23 GMT

Similar to above question is there a equivalent Palo Cortex tool as below from Microsoft ?

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

Also if we do not have Quarantine = Yes then does the file stay infected or is it cleaned and left there ?

Also unable to understand the link between the question and ' quota settings specified in the agent profile' ? How is it related ?

Overall I see Cortex talks of always protection ( blocking ) and Quarantine , so what about cleaning a infected file ?

Re: Cortex XDR Delete Malware

SimonTan — Fri, 18 Feb 2022 18:31:45 GMT

my solution is to get another antivirus to remove the source file (virus).

Re: Cortex XDR Delete Malware

bbarmanroy — Tue, 22 Feb 2022 03:25:36 GMT

Hi @Balaraju, quarantined files will need to be unquarantined manually.

The process of "cleaning a file" is very subjective. The file could be malicious by nature, or can be affected by a malicious process, among others. An example of that would be a ransomware attack. While the ransomware file is malicious and needs to be removed from the host, files affected by the ransomware are encrypted on disk and needs a decryption key for "restoring". The process of "cleaning" ensures a complete disk-wipe, and additional investigative and forensic activities to understand the limit of attack, exposure and compromise while figuring out the remediation plan including restoring from backups and enforcing stricter security controls to prevent such activities. This requires human intervention and analysis.

Re: Cortex XDR Delete Malware

bbarmanroy — Tue, 22 Feb 2022 06:02:19 GMT

Hi @SimonTan how about leveraging the existing capabilities of XDR to search and delete a file? Take a look at https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/response-actions/search-file-and-destroy.html

If you don't have Host Insights, you can write your own custom Python script for search files by names or hashes and delete them. See it here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/response-actions/run-python-scripts.html