topic Re: Cortex XDR_Behavioral threat detected (rule: excel_virus) in Cortex XDR Discussions

Cortex XDR_Behavioral threat detected (rule: excel_virus)

Seth_Sakshi — Wed, 20 Mar 2024 05:46:52 GMT

Hello All,

Greetings for the day!

We are getting multiple high severity alerts/incidents related with excel files because of Behavioral threat detected (rule: excel_virus).

Within the time span of 4 hours we have received 28 high severity alerts in 12 different hostnames. Also, the high severity alert is getting generated for the newly created excel file in the system without any macro or function being used.

Please help to answer the below queries-

On what basis these alerts are getting generated on legitimate files?
What need to be done to prevent these alerts from getting generated without any risk involved?
How these incidents can be thoroughly analyzed as for each & every file we can not ask the user about the source or legitimacy of the file?

Regards,

Sakshi Seth

Re: Cortex XDR_Behavioral threat detected (rule: excel_virus)

aspatil — Tue, 26 Mar 2024 08:12:33 GMT

Hello @Seth_Sakshi ,

Thanks for reaching out on LiveCommunity!

To answer your question, Cortex XDR uses WF verdict and local analysis to provide the verdict of file.

You can go through below training to learn how to do IR and fine tune the alerts:

https://live.paloaltonetworks.com/t5/customer-journey-prevent/scale-amp-optimize-xdr-prevent/ta-p/394035

If you want to confirm the reputation, you can involve SE or submit the file to TAC to confirm the reputation.

Regards.

Re: Cortex XDR_Behavioral threat detected (rule: excel_virus)

nsinghvirk — Tue, 26 Mar 2024 10:38:32 GMT

Hello @Seth_Sakshi

Thanks for reaching out on LiveCommunity!

This scenario require analysis of alert data to determine the root cause for alert. Hence please open a support case.