Bit of a weird one but has anyone experienced issues with office add ins that uses the clipboard functionality?
seem to be having intermittent errors with it and it just straight up not working.
Tried removing the cortex agent from one or two systems and it seemed to have restored clipboard functionality to the add in, one still did continue with errors after it was removed though.
I cant see any logs in cortex that would suggest it was blocking this so I am not 100% sure cortex is causing the issue but i just thought i would ask here and see if anyone had anything similar.
Agent version is 7.7.8
I see that you have mentioned agent version as 7.7.8.
It seems there is a typo, i believe you are referring to agent version 7.8 as there is no 7.7.8 version.
May I check what is the build version of XDR agent 7.8 you are using on problematic endpoints.
In this new version of XDR agent 7.8 there were some known issues identified with regards to clipboard functionality.
This issue has been fixed in latest build version of XDR agent 126.96.36.199264
If your agent lower than the version 188.8.131.52264, to resolve this issue, can you please upgrade or reinstall with this version.
Create a new agent installation package with version 184.108.40.206264 or above.
Then use this package to install or upgrade the agent on problematic endpoint.
Then monitor the endpoint to see if you are still facing the issue.
As per below article, you can find more information on the clipboard issue with 7.8 XDR agent version.
Please let me know the results of above actions.
Mark this as solution as an answer if it helped to solve the problem you are facing.
Ideally this issue should not be occurred with XDR agent version 220.127.116.11264 or above as per article shared.
The issue with clipboard functionality already addressed in this specific version.
However if you are still facing this issue with 18.104.22.168264, I would request you to log a support case to investigate this issue further.
Aside to above, you can also try downgrade to version 7.7.2 by uninstalling agent with 22.214.171.124264 and installing 7.7.2 version agent on the machine.
I hope that answers your query.
Yes I have opened a support case. The clipboard error goes away when uninstalling the Cortex Agent. We are only seeing the issue on Windows 10 clients after the upgrade to 126.96.36.199264 so I suspect the fix CPATR-17723 that was for Windows 7 and Windows 2008 R2 has introduced the issue to a new clipboard issue to Windows 10 endpoints.
Hi @creddy ,
For a quick test, what we can ask you is to add clipboard.exe to global/profile process exception(as per your choice) and select all modules under Module names. See how to do it below:
Once you have done that, you can try to enable modules one by one and checking which module makes an issue for you. Collect the support files and send it to the TAC for the fix.
Generally this can probably happen with exploits module. Ensure you have no other security solution running beside Cortex XDR which has similar exploit abilities like Cortex.
Sorry yes that was a typo i am using version 188.8.131.52264, i tried to make exception for clipboard.exe with all modules selected but to no avail and re-installing the agent didn't help either.
Only thing that worked was either removing the agent or dropping it down to 7.7.2.
I have opened a support case and currently awaiting to hear back.
Hi @ Rindsland support were able to send me on an exception that resolved the issue until its fixed.
The service in question that was causing the issue for us was the "XQL Enhancement to Support EDR user-related operations".
Dont know if this helps but might be worth mentioning to whoever is handling your case so they can send you on the support exception for it.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!