Cortex XDR and Sandboxie

[M.Wempen]

Hello,

We have installed Cortex XDR on a VM that also runs a sandbox tool (Sandboxie). As long as Cortex XDR is enabled, processes cannot be started within the sandbox (e.g., msedge.exe, cmd.exe, explorer.exe). It only works if I create a "Disable Injection and Prevention" rule for these processes.

How can I resolve this permanently? I suspect the issue is that Cortex prevents process hooking. Interestingly, we don't see any security cases or alerts being generated for this in the console.

Greetings and thank you 🙂

[Vinothkumar_SBA]

Hi @M.Wempen ,

Based on the behavior described, this appears to be a compatibility issue between Sandboxie's DLL injection/hooking mechanism and Cortex XDR's process injection and exploit protection framework.

The main indicator is that the applications launch successfully once a "Disable Injection and Prevention" rule is applied. Since Sandboxie relies on injecting components into processes running inside the sandbox, Cortex XDR may be interfering with that initialization process even though no security alert or incident is generated.

A few recommendations:

• Verify that both the Cortex XDR agent and Sandboxie are running the latest supported versions.
• Review Cortex XDR agent logs and diagnostic bundles for any injection- or exploit-protection-related entries during process startup.
• Use ProcMon or similar tools to compare process creation behavior with and without the exception.
• If possible, create a narrowly scoped exception for the Sandboxie service/broker process rather than excluding every sandboxed application (e.g., msedge.exe, cmd.exe, explorer.exe).

Since no alerts are being generated, this is likely a product compatibility issue rather than a standard prevention event. If the issue continues, I would recommend opening a Palo Alto Support case and providing agent diagnostics, Cortex XDR version, Windows build, and Sandboxie version so they can determine whether this is a known compatibility issue.

Please help other users by clicking ‘Accept as Solution’ if a post helps solve your problem.

Read more about how and why to accept solutions.

Best Regards,

Vinothkumar C

[M.Wempen]

For your recommendation
"If possible, create a narrowly scoped exception for the Sandboxie service/broker process rather than excluding every sandboxed application (e.g., msedge.exe, cmd.exe, explorer.exe)."

Which exception should i create? How can i determine which exception is necessary