topic Re: Cortex XDR blocking wps in Cortex XDR Discussions

Cortex XDR blocking wps

J.Mutesi376492 — Tue, 09 Sep 2025 13:29:03 GMT

Why is cortex xdr blocking wpscloudsvr.exe and wps.exe? In the artifacts there is also this: "kaccountsdk.dll". To me they all seem genuine, or am I missing something?
Also the initial cmd is confusing:
""C:\Users\a\AppData\Local\Kingsoft\WPS Office\12.2.0.22530\office6\wpscloudsvr.exe" /wpscloudlaunch /run_plugin /plugin_name=ktaskschdtool /plugin_entry=ktaskschdtool.dll /task=wpsexternal /launchtask /ver=1.0 /start_from=task_external_interval"
Kindly advise on what I can do.

Thanks

Re: Cortex XDR blocking wps

eluis — Tue, 09 Sep 2025 16:35:48 GMT

Hi @J.Mutesi376492

I dont have much information on what happened. Ill try to answer you the best I can:

If this is a wildfire verdict saying that legit files are malware, you can tweak the verdict using a button on the wildfire report

You can use alert tunning to prevent legit apps to be blocked, disable prevention rules or legacy exceptions from the settings--->exceptions configurations

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis