topic Re: Scaning files for malware in Cortex XDR Discussions

Scaning files for malware

Sedlacek — Thu, 23 Nov 2023 09:16:38 GMT

Is it possible to use Cortex XDR to analyse malicious Microsoft Office files, such as Word, Excel and PowerPoint documents? If I right click on Office file and choose Scan with Cortex XDR will Cortex check if that file is not used for delivering malware, including binary files, documents, scripts, archives a macros?

Re: Scaning files for malware

aspatil — Thu, 23 Nov 2023 12:01:21 GMT

Hello @Sedlacek ,

Thank you for writing to Live Community.

I hope below article will answer your query:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Protection-Capabilities

Please mark the response as "Accept as Solution" if it answers your query.

Regards.

Re: Scaning files for malware

aleksandar.astardzhiev — Thu, 23 Nov 2023 19:31:05 GMT

Hi @Sedlacek ,

So XDR applies so called "pre-execution" protections, where it analyzes the file when user tries to open/execute it, but before it is being allowed to run XDR do its checks.

File Scan, where it is on-demand (right click on file and scan now) or scheduled scan, essentially perform same checks on the file, but without the need for the user to open the file.

What it means is that, you may download malicious file, but if you don't scan it (manually or scheduled) and you never open it, XDR will never know that it is malicious. But if you open it it will be inspected. Same check will apply if you first scann it before open it.

Below picture indicates which checks will XDR apply when scaning a file. Those that are grayed out are done when file is opened, but not when file is being scanned.