Cortex XDR_Behavioral threat detected (rule: excel_virus)

[Seth_Sakshi]

Hello All,

Greetings for the day!

We are getting multiple high severity alerts/incidents related with excel files because of Behavioral threat detected (rule: excel_virus).

Within the time span of 4 hours we have received 28 high severity alerts in 12 different hostnames. Also, the high severity alert is getting generated for the newly created excel file in the system without any macro or function being used.

Please help to answer the below queries-

1. On what basis these alerts are getting generated on legitimate files?
2. What need to be done to prevent these alerts from getting generated without any risk involved?
3. How these incidents can be thoroughly analyzed as for each & every file we can not ask the user about the source or legitimacy of the file?

Regards,

Sakshi Seth

[aspatil]

Hello @Seth_Sakshi ,

Thanks for reaching out on LiveCommunity!

To answer your question, Cortex XDR uses WF verdict and local analysis to provide the verdict of file.

You can go through below training to learn how to do IR and fine tune the alerts:

https://live.paloaltonetworks.com/t5/customer-journey-prevent/scale-amp-optimize-xdr-prevent/ta-p/39...

If you want to confirm the reputation, you can involve SE or submit the file to TAC to confirm the reputation.

Regards.

[nsinghvirk]

Hello @Seth_Sakshi 

Thanks for reaching out on LiveCommunity!

This scenario require analysis of alert data to determine the root cause for alert. Hence please open a support case.