Allowing child process from parent process in Cortex XDR

[oburgos]

Hello,

Is there a way to allow a legitimate parent process to create a legitimate child process on Cortex XDR that is being blocked due to "Suspicious Process Creation"? In my case, I whitelisted the child process but the block continues. I do not want to whitelist the parent process as this may allow malware into our environment someday.

I remember version 4.1 of Traps allowing this under Child Process Protection (I think was the name). For example "ParentProcess.exe ->spawns-> ChildProcess.exe : Allow". I looked into the exception profile, but it only allows me to create an exception for just one specific process.

If anyone has an idea of if/how to accomplish this with Cortex XDR, please let me know! Thank you, stay safe.

[ajrechk]

Hi, I believe this may be what you are looking for:

• Under Endpoints go to Policy Management
• Then select Profiles on the left under the Prevention heading
• Find your active Malware profile and right-click and Edit
• Scroll down to Malicious Child Process Protection

You will then find a whitelist option to do a combo of the parent and child process along with any specific parameters