Cortex XDR blocking TeamViewer again....

[ReisingerM]

Hello everybody,

in the night from yesterday to today Cortex XDR disabled and quarantined TeamViewer (tv_x64.exe to be more specific) on a lot of our devices. We are using TeamViewer to offer support to our external offices. Does anybody else have this problem or might know why this got triggerd all of a sudden.

Thank you in advance,

ReisingerM

[creddy · Accepted solution]

Hi @ReisingerM 

Are you able to see which component of XDR agent is blocking file?

The immediate workaround is, if the blocked file is trusted one, you can create exclusion for it to prevent from being blocked.
Refer below article for same.
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...

Aside to above, if the wildfire module is the one blocking the file here, you can also request a verdict review for a sample as per this documentation here under "Report an incorrect verdict to Palo Alto Networks":

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-respo...

You could also create file level exclusions in Malware profile policy. This will help to exclude the file even when the file hash changed as part of its software updates.
Refer STEP 3 in link : https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-...

I hope that helps to address your problem here. 

However you can still log a case with support to get more help.

[ReisingerM]

Hello Creddy,

thank you for your fast answer. It did get blocked by the Wildfire module but the way i see it PaloAlto already adressed this issue since the WildFire Verdict changed back to bening.

Thank you for your help.

[MithunKT]

Hi @creddy 

Even we too facing this issue.

Alert name: Wildfire malware

Category: Malware

Module: WildFire post detection

Files are identified as malware, only to be analyzed in WildFire and come back as benign, these files remain as verdict "Malware". Is it possible to explain "wildfire post detection" module logic ?

Thanks

[creddy]

Hi @MithunKT 
I hope this detection issue already resolved at your side.
To cross check, you can try to re execute the program again. Agent should not throw alerts any more for this particular file.
However If you are still getting issues, perform Agent checkin or wait for 5 min at least to allow the agent to perform heartbeat with servers to fetch new policies. This should ideally solve the problem here.

Aside to above, this kind of post detection will happen in some rare cases.
If you need any more information on this matter, I believe it will be good to log a support case.