Cortex XDR blocks MalwareBytes

GaryM — Tue, 18 Feb 2025 14:07:20 GMT

After a recent update to MalwareBytes Cortex XDR is now detecting and blocking it.

Has anyone else seen this, and is there a was to allow the MalwareBytes Digital Signature? I prefer not to have to allow the hash for each version.

Re: Cortex XDR blocks MalwareBytes

aspatil — Wed, 19 Feb 2025 05:41:02 GMT

Hello @GaryM ,

I would suggest you to first have a TAC case opened to confirm the reputation of the detection. This may be post-detection alert, this kind of alert triggers when a benign file is allowed to run in an environment but later the verdict gets changed to malware in the cloud. Please refer to the Wildfire Post-Detection (Malware and Grayware) in the below document. https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-concepts/endpoint-protection-modules.html

TAC can help you to identify and correct the reputation. If it is legitimate malware detection, and you want to accept this risk, you can go with exception configuration.

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

topic Re: Cortex XDR blocks MalwareBytes in Cortex XDR Discussions

Cortex XDR blocks MalwareBytes

Re: Cortex XDR blocks MalwareBytes