Block Execution of Specific Applications Regardless of Location

[J.Lopes154290]

I want to prevent the execution of anydesk.exe, choco.exe, and cloudflared.exe. However, I went to the Prevention Policy Rules and created restrictions for applications, but it only allows blocking in specific locations, so that doesn't meet my needs. I want these applications to be blocked whenever they are detected anywhere in the system.

Cortex XDR 

[eluis · Accepted solution]

Hi @J.Lopes154290 

To block executions in your use case you can do several things: 

1. Block hashes (one by one): going to action center and click on add new action and block list. Bear in mind that changes here will take effect on agents after the next check-in of the agent
2. Block hashes (bulk number of hashes from file import): going to action center and click on Import Hash Exceptions.
   Check the video on how to do it: https://live.paloaltonetworks.com/t5/cortex-xdr-how-to-videos/cortex-xdr-how-to-video-import-file-ha...
3. Add a restriction profile and play with the wildcards to implement your use case:
   https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Set-up-restrictio...

Realize that hashes can change if files are updated for example new versions of the same sofware are uploaded. 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

[eluis · Accepted solution]

Hi again @J.Lopes154290 , 

There is something else you can do. 

You can block the remote access software by signer. The cons are that if this software vendor, develops other software that is not for remote access you are blocking it too. 

Create a BIOC just adding the signer you want to block (TeamViewer, etc... whatever you want), then you can test it if you want to make sure it works as expected.

At this point BIOC is just alerting, not blocking anything

To block: right clicking on the BIOC you can add it to a restriction profile. This will send the BIOC to the agents under that policy rule and will start blocking that signer, any software from that signer. 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis