topic Re: Piloting XDR 7.3.1, policies seem more stringent- blocking previously allowed scripts and .exes in Cortex XDR Discussions

Piloting XDR 7.3.1, policies seem more stringent- blocking previously allowed scripts and .exes

WORRELLR — Fri, 07 May 2021 14:31:28 GMT

We are in the process of updating our endpoint XDR agents from 7.2 to 7.3.1. We are testing on a small pilot group and finding that scripts and executables that we previously ran are now being blocked. Granted some these scripts are stopping and starting services and removing files. We are concerned if we deploy it site-wide that we'll have many more blocks. Some are being blocked on BTP and some via Child Process. Have the policies changed, are they more stringent. I've read the release notes and didn't get much information from them. Thanks in advance!

Re: Piloting XDR 7.3.1, policies seem more stringent- blocking previously allowed scripts and .exes

KRisselada — Fri, 07 May 2021 16:45:05 GMT

Hi @WORRELLR just wondering what Content Version did you see the Child Process being blocked? I know for a fact that I seen a customer that just recently had a lot of processes on some build servers that were blocked as they were spawned from Java and it resulted in needing to put in a temp "fix" in the malware profile (in the malicious child process protection section) until later that day Cortex Operations released a "911" content update. This occurred with Content Update 179-57885 and was "fixed" via content update 179-57935 the same day. Support stated that a fix in Cortex XDR endpoint itself would occur likely in v7.4 (sometime June)

I assume 7.3.2 is likely too far down the QA process timeline to put it there and delay that coming out (<< just my guess. I have no prior or inside info)

Re: Piloting XDR 7.3.1, policies seem more stringent- blocking previously allowed scripts and .exes

WORRELLR — Fri, 07 May 2021 17:53:12 GMT

Thanks so much for the response, VERY helpful info! Our alerts were occurring 4/4 and the morning of 4/5. We actually had a few servers with the same issue that you had mentioned, had multiple blocks of a child process being spawned from JAVA. I see the latest content update (179-57935) hit the machines on the afternoon of 4/5 and we haven't seen the issue since then. We were just concerned moving forward. I feel more comfortable now, moving forward with 7.3.1 and later in June to 7.4. Thanks again.

Re: Piloting XDR 7.3.1, policies seem more stringent- blocking previously allowed scripts and .exes

KRisselada — Fri, 07 May 2021 21:04:38 GMT

excellent! glad it was helpful