topic Re: Post detected by Wildfire in Cortex XDR Discussions

Post detected by Wildfire

RFeyertag — Thu, 22 Jun 2023 21:21:43 GMT

Hello dear community,

what means Detected (Post Detected)?

In our case, we see pdfpower.exe incidents popping up, the user says he didn't download anything to the incident time.

I think, the agent is scanning the OS, when there is allready a quarantaine or blacklist entry?

What do you think?

Rob

Re: Post detected by Wildfire

nsinghvirk — Fri, 23 Jun 2023 14:54:46 GMT

Hello @RFeyertag

Detected (Post Detected) means that a particular file was earlier detected and since then its verdict has flipped from benign to malware. This happens when XDR waits for wildfire verdict for file whose's verdict is unknown and meanwhile Local Analysis has given a benign verdict, later wildfire comes with malware verdict. File was already executed and XDR generates a high severity alert with action as Detected (Post Detected).

Re: Post detected by Wildfire

Kavurisowmya — Fri, 22 Sep 2023 06:34:12 GMT

What does Prevented (Post detected) mean?

Re: Post detected by Wildfire

PiyushKohli — Fri, 22 Sep 2023 10:07:42 GMT

Hi @Kavurisowmya

"Prevented (Post Detected)" indicates that the verdict for a process has been changed to malware from benign and an agent terminated because the process was still running.

While "Detected (Post Detected)" as shared above by @nsinghvirk indicates that the verdict for a process has been changed to malware from benign and that process was executed in the past but not running anymore.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Re: Post detected by Wildfire

RFeyertag — Fri, 22 Sep 2023 15:24:45 GMT

Thank you very much for this clarification!

Rob

Re: Post detected by Wildfire

Arman_Zaheri — Wed, 12 Feb 2025 09:30:02 GMT

I have a similar "Detected" (Post Detected) case where the WildFire verdict has changed. However, the initial execution of the executable file dates back to three months ago. The file was already submitted to VirusTotal (first submission date: 2009) and is detected by multiple vendors as malware (VirusTotal - File - 52f28b84699922bb7be7621581e7133ee3d34a34f41e4bc779357c6ec8ca09b7).

My question is: Does Cortex solely rely on WildFire detection to block malware, or does it also consider other intelligence sources? In my case, it doesn't seem to be the latter.

Re: Post detected by Wildfire

Aristooo — Thu, 27 Feb 2025 06:46:12 GMT

Hi @PiyushKohli,
Even though that file was previously on the computer but is no longer present, is the post detected alert still being triggered?

Re: Post detected by Wildfire

PiyushKohli — Thu, 27 Feb 2025 07:06:54 GMT

Hi @Arman_Zaheri and @Aristooo
Please find update to your query.

For this query: "Does Cortex solely rely on WildFire detection to block malware, or does it also consider other intelligence sources? In my case, it doesn't seem to be the latter." Answer is No. Wildfire is just one protection module, Cortex XDR has a multi layer of defense approach that allow us to look at an activity from different angles and in different timestamps of the threat. Wildfire in this case is just for pre-execution, even if execution happens XDR agent will monitor the behavior and can detect/prevent the malicious activity. Hope this clarifies.

@Aristooo to your query "Even though that file was previously on the computer but is no longer present, is the post detected alert still being triggered?" Alert will triggered if there was an execution of that file, and in scenario if there was no execution then there won't be any alert as that file is just sitting on disk.

Hope this helps and clarifies!

Re: Post detected by Wildfire

Aristooo — Thu, 27 Feb 2025 07:26:32 GMT

@PiyushKohli thank you for your response.
The interesting thing is that I deleted that file several months ago. There is also no regular application related to the file on the computer. However, today the post-detection alert was triggered.

Re: Post detected by Wildfire

Arman_Zaheri — Thu, 27 Feb 2025 08:14:00 GMT

Hi @PiyushKohli ,

My question was, why Cortex didn't block the file or raise an alert despite the fact that at the time of execution, the VirusTotal's verdict was malicious for that file, but Cortex still decided not to raise an alert for it. So, to me, it seems that Cortex's internal mechanisms did not take VirusTotal's verdict into account in this particular case.