topic Re: Cortex Pop-ups Triggered for StoreDesktopExtension.exe Despite Being Blocklisted in Cortex XSIAM Discussions

Cortex Pop-ups Triggered for StoreDesktopExtension.exe Despite Being Blocklisted

J.Fernando795842 — Wed, 21 Jan 2026 17:59:38 GMT

Users are continuing to receive Cortex alert pop-ups for StoreDesktopExtension.exe even after the executable was added to the Cortex block list.

Observations:

The file is already present in the Cortex block list.
Alerts/pop-ups are still being triggered on user endpoints
Is it related to Windows Security Update?
Restarting the machine is resolving the issue. However, post that the "Windows Store App" cannot be accessed

Re: Cortex Pop-ups Triggered for StoreDesktopExtension.exe Despite Being Blocklisted

neelrohit — Fri, 23 Jan 2026 10:10:14 GMT

Hi @J.Fernando795842 ,

this was a known issue where the wildfire detection engine has got updates from threat intel about specific Hash related to this application and was flagged malicious. However, this was immediately reverted and the effects on the tenant may last a few hours. Inorder to prevent business impact, you can consider adding the SHA256 to allow list for the time being and remove it later.

Hope this helps. Please mark the response as "Accepted as Solution" if helps

Re: Cortex Pop-ups Triggered for StoreDesktopExtension.exe Despite Being Blocklisted

tonacoecarvalho.adv — Sun, 25 Jan 2026 05:15:45 GMT

Hi,
Known false positive: StoreDesktopExtension.exe is legit MS Store component, flagged by Cortex behavioral rules during updates/servicing.

Block list stops execution but not BIOC alerts/pop-ups. Restart clears cache temporarily, but can break Store if quarantined earlier.

Fix:

Exceptions > Add File exception:
Allow

Path: *StoreDesktopExtension.exe
Or full: C:\Program Files\WindowsApps\Microsoft.WindowsStore_**\StoreDesktopExtension.exe
Add SHA256 from alert

In alerts/incidents: close as FP > suppress rule for this hash/behavior
Force sync: host > Response > Refresh Policy
(or endpoint: cytool checkin)

If Store broken: run wsreset.exe or reset via PowerShell:

Get-AppXPackage WindowsStore -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml"}

Alerts stop after sync. If not, send BIOC ID / SHA256 / agent version, I'll script the exact suppression.

Guilherme Lucas
Senior Security Researcher | Red Team / Exploit Dev