topic Re: Exceptions "Child process" in Cortex XDR Discussions

Exceptions "Child process"

Julitro — Wed, 26 Aug 2020 17:09:19 GMT

Hello!!

How are you? i need confirm an action when add exception for child process, i have several alerts for "WmiPrvSe.exe Rare Child Process" that are false positive, and im considering add to whitelist in the profile associated.

For create it i need add parent process, child process and child process command, I need confirm if this works as a string? In other words, the child process will be excepted only if it is created from parent that i specified, right?

I have other question, is there a way to create these exceptions "child process" for just one host, without the need to create a policy for just this host?

Thanks very much!

Re: Exceptions "Child process"

DKasabji — Sun, 13 Sep 2020 18:20:27 GMT

Hello,

1. Yes, this will work as you expect it, it will whitelist the child process based on the parent process + child process parameters that you provide. If such behavior is detected by Cortex XDR Agent it will allow to run through.

2. As far as I know, there is no way to create exceptions only for a single host other than creating a policy for that specific use case. I would say that this is nothing bad to create such policy, because in your case, this is a very specific exception you want to do. Just remember to re-order it in Policy Management, so that it gets checked first.

Best,