topic Re: Suspicious executable detected Microsoft Store Purchase App in Cortex XDR Discussions

Suspicious executable detected Microsoft Store Purchase App

Juliortega — Thu, 28 May 2026 19:16:08 GMT

Hello everyone,

Has anyone seen this process appear in Cortex XDR?

C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_22603.1401.4.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe

It’s showing up on an endpoint, but Cortex XDR isn’t providing any additional details, alerts, or related events. Before I dismiss it, I want to confirm whether this is expected behavior or if anyone has seen suspicious activity tied to this executable.

Any insight is appreciated.

Re: Suspicious executable detected Microsoft Store Purchase App

sherefa — Mon, 01 Jun 2026 09:39:56 GMT

Hello,

Yes, we are having the same issue, and we are following with the support they recommended to add an exception. not yet added.

there are multiple processes related to Microsoft but without any signature, even though the process in it's correct path.

Re: Suspicious executable detected Microsoft Store Purchase App

andreal — Mon, 01 Jun 2026 11:48:15 GMT

We also have the same issue. We saw 3 different hashes for "StoreExperienceHost.exe" over the past 6 weeks. It's always a Local Analysis Malware alert. The WildFire verdict is then benign, so no action is really needed, but still annoying to get these alerts.

Re: Suspicious executable detected Microsoft Store Purchase App

Joe_Carissimo — Tue, 02 Jun 2026 21:16:59 GMT

We are seeing the same exact thing here in our shop. Palo did eventually give us a SUEX file to quiet the noise. I'd prefer that they fix whatever is determining that file to be suspicious. This is not the first time we've had something similar happen with MS Store files.

Re: Suspicious executable detected Microsoft Store Purchase App

Karl-Foley — Wed, 03 Jun 2026 11:01:56 GMT

We were also suffering from this. I remember seeing it was addressed in a content pack update. We're only seeing this on endpoints without the current content pack now.