topic Re: New to Cortex - Whitelisting files/paths, are they needed in Cortex XDR Discussions

New to Cortex - Whitelisting files/paths, are they needed

jeperjes — Mon, 10 Oct 2022 12:20:27 GMT

I am looking for definitive answers on whether or not exe files should be whitelisted and where they should be whitelisted within Cortex?

Re: New to Cortex - Whitelisting files/paths, are they needed

jeperjes — Mon, 10 Oct 2022 13:57:48 GMT

the files to be excluded are known windows files.

Re: New to Cortex - Whitelisting files/paths, are they needed

Cyber1985 — Mon, 10 Oct 2022 17:52:43 GMT

Maybe palo alto could bringt out a short Video for white and blacklisting paths/files?

Rob

Re: New to Cortex - Whitelisting files/paths, are they needed

Cyber1985 — Mon, 10 Oct 2022 17:55:51 GMT

I would also be interested, if this Feature from Cortex xdr pro is comparable to applocker.

Rob

Re: New to Cortex - Whitelisting files/paths, are they needed

neelrohit — Tue, 11 Oct 2022 01:32:38 GMT

@jeperjes @Cyber1985 ,

It likely depends on the used cases on what should be whitelisted. Definitely the easiest, quickest and the best whitelisted always is SH256 allow list, which is granular in itself. However, as iterated, when it comes to whitelisting executables, it would depend upon the business used case and alerts around it.

Windows executables are microsoft signed application executables and because Microsoft is a highly trusted signer, Cortex XDR does not detect and examine it in the pre-exection stages(like Wildfire malware, Local Analysis).

In the post execution stages, everything is examined as it leverages behavioral execution monitoring for script based, fileless attacks and exploitation events as well.

We also have a process exception which has the capability to disable select protection modules for Cortex XDR depending upon the choices and used cases.

Please be apprised all of the above, will be specific to targets and profiles and should be implemented very carefully

Re: New to Cortex - Whitelisting files/paths, are they needed

jeperjes — Wed, 12 Oct 2022 15:52:01 GMT

what is the right way to enter *.exe files into whitelists, or find the
hash of a file and add that to the whitelist? What is the right way to
handle files to whitelist to avoid malicious files attacking a server? I
am not familiar with the cortex and how they handle malwares.

Re: New to Cortex - Whitelisting files/paths, are they needed

jeperjes — Tue, 23 Jul 2024 19:40:14 GMT

yes they should.