Some of the users of Cloud2Model are resporting that Cortex XDR is blocking the installer "Cloud2Model Manager 1.005 x64 setup.exe" with this Cortex XDR code: c0400055. This is a legitimate application and the installer is signed with a EV code certificate. You can check the instaler here:
Please check this issue ASAP. I am very interested in knowing the reasons that trigger to block the file.
Many thanks in advance.
Hi @eproca ,
From what I can tell, you may be encountering an issue where Local Analysis has determined that your sanctioned software is malware and is blocking it due to policy configuration. To override the local analysis verdict and permit this software to run immediately, you can apply the hash for the file in the Allow List for Cortex XDR using the following instructions.
To understand why your file was blocked, I would recommend opening the Hash View to see the information collected by Cortex XDR in terms of the threat intelligence and the incidents related to the hash. You can access the Hash View by clicking the circle icon () on the top-right of your screen, pasting the hash into the search bar, and clicking, "Open Hash View of..." There you will find more information regarding the hash and the verdict provided.
Please let me know how this goes when you have the opportunity.
hi @gjenkins ,
Thanks for your feedback. I am the application developer but not the Cortex XDR user. I dont have any direct access to the Action Center of Cortex XDR or possibility to check the Hash View. Anyway I will pass the information to the actual Cortex XDR users.
Is there any way to "white list" a file globally for Cortex XDR? I mean without having to be an actual user of Cortex XDR. Some antivirus have proccedures and protocols for this kind of situations.
Many thanks in advance for your support
As you mention, I would get in touch with your XDR admin and refer him to the following links.
You also mentioned that the application you want to allow is also digitally signed. You can also add the signature to the Allow List Signer in the Malware Profile,
Passing the information along to the Cortex XDR administrators for your instance is the best next step in this case. Thank you for forwarding it. Once they have applied the hash to the allow list, it will apply to all endpoints within your environment.
You can add to the allow list for your environment globally by using the instructions above or watching the following video.
As for a true global verdict via Wildfire submission, the best way to submit is by executing the file on a device with Cortex XDR. Once executed, Wildfire will receive a copy submitted from that endpoint and provide its verdict within 24 hours. That verdict is distributed globally across all tenants.
One question: the application is signed with an EV code certificate. @fmoixsante explains that it can be added to an Allow List Signer in the Malware Profile. Will this help to avoid false positives in future files signed with the same certificate? Honestly, I am not so amused with the idea that each new future installer will need some kind of special managment by the Cortex XDR administrators.
Thanks in advence for the support.
That's a great question, @eproca .
Adding your signers to your allow list will exclude signed "executable files, macros, or DLL files on Windows endpoints, Mach-O files or DMG files on Mac endpoints, ELF files on Linux endpoints, or APK files on Android endpoints" from the malware examination. It will still be subject to scrutiny by other protective modules such as Behavior Threat Protection, Child Process Protection, and any other applicable module given the activities observed.
We are here to support if a false-positive is found. If it does happen, please feel free to have the XDR administrators submit a verdict change request or open a case with Support to investigate further.
Thanks again for the support @gjenkins.
I have been told that after one day the same installer file did not trigger any warning from Cortex XDR any more. And without any action from the administrators of Cortex XDR. Maybe some action in the paloaltoN side?. Anyway thanks again for the support.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!