Signer of a file in file operations

RFeyertag — Wed, 12 Oct 2022 18:25:06 GMT

Hello dear community,

like I saw, there is no possibility to find out the signer, from files which were only downloaded, moved, etc. but not executed.

Why is this not possible?

Rob

Re: Signer of a file in file operations

bbarmanroy — Fri, 14 Oct 2022 01:40:18 GMT

Hi @RFeyertag as you might be aware, Cortex XDR detects and prevents malicious events during execution. The information that you're looking for is collected by modules invoked during execution.

It is possible to collect the data, but currently it is not part of the functionality.

Would you have any specific use cases where you'd be looking at the metadata of such files (many of which might not be executables) to comprehensively aid in your investigation flows? I assume you're not referring to use cases pertaining to forensic investigations.

topic Re: Signer of a file in file operations in Cortex XDR Discussions

Signer of a file in file operations

Re: Signer of a file in file operations