topic Re: Block Exe Files in User Download Folder in Cortex XDR Discussions

Block Exe Files in User Download Folder

s.debus — Tue, 03 Jan 2023 14:15:33 GMT

Hello,

i know that i can block specific files in cortex but i am looking for a solution how i can block only .exe files in Users download folder.

In the Malware Profiles i can see that there is only a allow list where i can write single filenames that will be allowed.

Do you have any idea how i can realise this?

Best Regards

Sascha

Re: Block Exe Files in User Download Folder

timurphy — Tue, 03 Jan 2023 15:29:37 GMT

Hello @s.debus,

This use case could be accomplished via a Restrictions Profile. You can create a new Restrictions Profile by navigating to Endpoints>Policy Management>Prevention>Profiles and clicking "Add Profile."

Under the "Executable Files" section, change the action mode to "Block" and add your desired filepath(s) to the block list. For example, you could add %USERPROFILE%\Downloads\*.exe to specifically block files with the .exe extension, or you could add %USERPROFILE%\Downloads\* to block additional types of executable files as well:

After you have adjusted the profile to your liking, save the profile and make sure it is assigned to the proper endpoint(s) via a Prevention Policy Rule.

I hope that answers your question!

Regards,
Tim

Re: Block Exe Files in User Download Folder

s.debus — Wed, 04 Jan 2023 08:04:07 GMT

Hello Tim,

thank you. You made my day. I'll try it.

Best Regards

Sascha