topic Re: Block Execution of Specific Applications Regardless of Location in Cortex XDR Discussions

Block Execution of Specific Applications Regardless of Location

J.Lopes154290 — Mon, 18 Aug 2025 16:06:27 GMT

I want to prevent the execution of anydesk.exe, choco.exe, and cloudflared.exe. However, I went to the Prevention Policy Rules and created restrictions for applications, but it only allows blocking in specific locations, so that doesn't meet my needs. I want these applications to be blocked whenever they are detected anywhere in the system.

Re: Block Execution of Specific Applications Regardless of Location

eluis — Tue, 19 Aug 2025 18:49:05 GMT

Hi @J.Lopes154290

To block executions in your use case you can do several things:

Block hashes (one by one): going to action center and click on add new action and block list. Bear in mind that changes here will take effect on agents after the next check-in of the agent
Block hashes (bulk number of hashes from file import): going to action center and click on Import Hash Exceptions.
Check the video on how to do it: https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/cortex-xdr-how-to-video-import-file-hash-exceptions/ta-p/503616
Add a restriction profile and play with the wildcards to implement your use case:
https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Set-up-restrictions-prevention-profiles#

Realize that hashes can change if files are updated for example new versions of the same sofware are uploaded.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

Re: Block Execution of Specific Applications Regardless of Location

eluis — Wed, 20 Aug 2025 14:01:06 GMT

Hi again @J.Lopes154290 ,

There is something else you can do.

You can block the remote access software by signer. The cons are that if this software vendor, develops other software that is not for remote access you are blocking it too.

Create a BIOC just adding the signer you want to block (TeamViewer, etc... whatever you want), then you can test it if you want to make sure it works as expected.

At this point BIOC is just alerting, not blocking anything

To block: right clicking on the BIOC you can add it to a restriction profile. This will send the BIOC to the agents under that policy rule and will start blocking that signer, any software from that signer.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis