clipboard functionality

[KarlHalpin]

Hi Guys,

Bit of a weird one but has anyone experienced issues with office add ins that uses the clipboard functionality?

seem to be having intermittent errors with it and it just straight up not working.

Tried removing the cortex agent from one or two systems and it seemed to have restored clipboard functionality to the add in, one still did continue with errors after it was removed though.

I cant see any logs in cortex that would suggest it was blocking this so I am not 100% sure cortex is causing the issue but i just thought i would ask here and see if anyone had anything similar.

Agent version is 7.7.8

[creddy]

Hi @KarlHalpin 
I see that you have mentioned agent version as 7.7.8. 
It seems there is a typo, i believe you are referring to agent version 7.8 as there is no 7.7.8 version.

May I check what is the build version of XDR agent 7.8 you are using on problematic endpoints.

In this new version of XDR agent 7.8 there were some known issues identified with regards to clipboard functionality.
This issue has been fixed in latest build version of XDR agent 7.8.0.64264

If your agent lower than the version 7.8.0.64264, to resolve this issue, can you please upgrade or reinstall with this version.

Create a new agent installation package with version 7.8.0.64264 or above.

Then use this package to install or upgrade the agent on problematic endpoint.
Then monitor the endpoint to see if you are still facing the issue.


As per below article, you can find more information on the clipboard issue with 7.8 XDR agent version.
https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-8/cortex-xdr-agent-release-notes/cortex-xdr-ag...

Please let me know the results of above actions. 

Mark this as solution as an answer if it helped to solve the problem you are facing.
Thank you!

[jruck]

We are seeing similar clipboard issues in Excel only after endpoints upgrade to 7.8.0.64264. We are getting errors that the clipboard is full and there's a problem with the clipboard.

[creddy]

Hi @jruck 

Ideally this issue should not be occurred with XDR agent version 7.8.0.64264 or above as per article shared.
The issue with clipboard functionality already addressed in this specific version.

However if you are still facing this issue with 7.8.0.64264, I would request you to log a support case to investigate this issue further.

Aside to above, you can also try downgrade to version 7.7.2 by uninstalling agent with 7.8.0.64264 and installing 7.7.2 version agent on the machine.

I hope that answers your query.

[jruck]

Yes I have opened a support case. The clipboard error goes away when uninstalling the Cortex Agent. We are only seeing the issue on Windows 10 clients after the upgrade to 7.8.0.64264 so I suspect the fix CPATR-17723 that was for Windows 7 and Windows 2008 R2 has introduced the issue to a new clipboard issue to Windows 10 endpoints.

[creddy]

Thanks @jruck for update.
TAC team will help you further to resolve the issue.
I hope my suggestion above helped to address your concern.
Please mark it as solution if you found it helpful.
Thank you!

[neelrohit]

Hi @creddy ,

For a quick test, what we can ask you is to add clipboard.exe to global/profile process exception(as per your choice) and select all modules under Module names. See how to do it below:

(https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000POLaCAO

Once you have done that, you can try to enable modules one by one and checking which module makes an issue for you. Collect the support files and send it to the TAC for the fix. 

Generally this can probably happen with exploits module. Ensure you have no other security solution running beside Cortex XDR which has similar exploit abilities like Cortex.

https://docs.paloaltonetworks.com/compatibility-matrix/cortex-xdr/cortex-xdr-compatibility-with-thir...

[KarlHalpin]

Hi @creddy,

Sorry yes that was a typo i am using version 7.8.0.64264, i tried to make exception for clipboard.exe with all modules selected but to no avail and re-installing the agent didn't help either.

Only thing that worked was either removing the agent or dropping it down to 7.7.2.

I have opened a support case and currently awaiting to hear back.

[neelrohit]

@creddy ,

Thank you so much for your response and efforts. I am sure your issue would be in good hands with Palo Alto Networks support. Please let us know the final findings and we shall be happy to suggest workarounds for future used cases like these.

[jruck]

Support gave us a Support Exception to apply to the endpoints that has resolved the issue clipboard for now until a fix is available.

[KarlHalpin]

Hi @jruck are you able to tell me the exception or is a support exception something palo alto send on to you? 

[jruck]

It was a support exception file that Palo Alto support sent us to upload to our Cortex Exceptions profile. 

[Rindsland]

We have the problem here, I opened a Case for it.

[KarlHalpin]

Hi @ Rindsland support were able to send me on an exception that resolved the issue until its fixed.

The service in question that was causing the issue for us was the "XQL Enhancement to Support EDR user-related operations".

Dont know if this helps but might be worth mentioning to whoever is handling your case so they can send you on the support exception for it. 

[Rindsland]

Yes, I did that and received the Support Exception now.

Now we can copy/paste in Excel 2-3 times and then after this we still get the Error
"We couldn't free up space on the Clipboard" 

So for us it's not fully resolved with the Exception.