Cortex XDR has Blocked a Malicious Activity but No Program Listed

[mixzawa]

Attached images show the pop-up that is going around our network this morning.  Unlike before where it would list the program Cortex blocks there is nothing there and is pointing at Microsoft for the cause.

Is this a false positive?  A windows service is triggering Cortex to block the behavioral threat?

[mdb1998]

We're getting the same type alert this morning on all our endpoints.  We haven't determined what is causing it though.

[KMcKenna]

We are seeing Cortex Behavioral Threat High Blocks related to Microsoft.  Pretty much all end points.   smss.exe .. a MSFT signed file is identified.   Unclear what is the precise cause. 

[mixzawa]

Minor update my home office PC (Windows 100 Pro) now got the notification from XDR while at work we use Windows 10 Pro.  Can never have a quiet day off can I?  😛

[as-mg]

Hi,

We're seeing the same here as well. End users are shown no application name, but digging through the incidents in the console shows that it's killing of Smss.exe, which is the System Center Configuration Manager agent.

All endpoints generating alerts are running 7.7.0.60725 here.

Looking through the timeline there seems to be no evidence of foul play.

[KMcKenna]

We are on 7.7.0 as well.

Thanks for the comment

[as-mg]

This alert just trigged on my personal device when updating to content version 500-90199.
Sooo... rollback, please?

[KMcKenna]

We have a Support ticket opened (High Severity) and also are working with an inside (Palo) engineer associated with our Sales team.  So hopefully we will learn more soon.

[as-mg]

@KMcKenna Please let us know if they provide a workaround or a fix for the issue.

Fingers crossed the update either get fixed or pulled tonight, so I won't have to deal with this when each endpoint boots tomorrow.

[KMcKenna]

Yes, absolutely.

For reference, if anyone else opens a case, our Case # is 02191931.

The rule triggering the alert is: 

Behavioral threat detected (rule: other.malware_gen_task.105)

[adminBandE]

Getting this too. It occurs after the latest content & policy update. I can manually trigger it but clicking check-in now button, so its like the process that applies the policy update is triggering itself lol.

You can verify this in the endpoint log on portal, it triggers same time as the policy

update. 

Support case logged also: 

CASE #: 02191983

 

  

[KMcKenna]

@adminBandE   I also clicked Check In Now on a completely isolated host (off site).   Had same response as you in that the Alert triggered.

Will add that to our support case.  Thanks

[adminBandE]

Update from my Case:

From the case description, I understand that you are receiving BTP alerts for smss.exe for the rule other.malware_gen_task.105
I would like to inform you that it is a false positive BTP alert and multiple customers where reported the same. We are working on the fix and will update you as soon as available.
As a workaround please create an alert exception for now reference.

I just created the (temporary) exception, lets see if it takes effect!

Edit: It does work. Apply the alert exception from the incident under alerts & insights, right-click the alert and select manage alert - create alert exception.  It will then appear under your global BTP rules. 

[mixzawa]

Hoping for all of us as user calls about will get very old very fast.

[KMcKenna]

We are being told this is a False Positive and the Palo Support team is working on it.   They say to create an exclusion in the meantime.  Some general info on doing that...

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/exception...

This is a general Docs page.  So if you are not familiar with doing this, you may need more info.   This is linked info not specific to this alert.

That's all I have at the moment.