Cortex XDR Pro – Does it scan USB devices upon insertion?

[QuestionAb]

Hi team,

I would like to confirm the behavior of Cortex XDR Pro regarding USB devices:

• Does Cortex XDR perform any automatic malware scan when a USB device is connected to an endpoint?
• If not, what protections are applied at connection time (e.g., device control, behavioral detection, execution monitoring)?
• Is scanning of removable media only performed during periodic or on-demand scans?
• Or at least, any configuration inside the agent settings profile?

Appreciate your clarification and any best practices for securing USB usage with Cortex XDR.

[susekar · Accepted solution]

Hello @QuestionAb ,

Greetings for the day.

Cortex XDR Pro does not perform an automatic malware scan of a USB device immediately upon connection or mounting. This specific functionality (Scan-on-Connect) is a known product limitation and is currently tracked under feature request CXDR-I-305.

However, Cortex XDR provides a multi-layered defense to secure USB usage through execution-based prevention and access controls.

1. Protections Applied at Connection Time
While a full scan is not triggered, the following protections are active at the time of connection or file interaction:

• Device Control: This module allows you to block, allow, or set USB storage devices to "Read-Only" mode based on device classes (Disk Drive, Portable Device, CD-ROM) or specific hardware descriptors such as Vendor ID, Product ID, and Serial Number.
• Behavioral Threat Protection (BTP): Cortex XDR includes a dedicated BTP module to identify and block malicious or spoofed USB devices, such as "Rubber Ducky" HIDs (Human Interface Devices) that masquerade as keyboards or mice to execute malicious commands.
• Real-time & On-Write Protection: The agent performs real-time scanning and behavioral analysis the moment a file is accessed, copied, or executed from the USB device.
• Execution Monitoring: Any file attempting to run from the USB is subject to the full suite of malware protection modules, including Local Analysis and WildFire.

2. Available Scanning Methods
Scanning of removable media can be performed through the following mechanisms:

• Periodic Scans: You must explicitly enable the option Scan Removable Media Drives within the Malware Security Profile under the Periodic Scan settings.
• Manual/User-Initiated Scan: If the End-user Initiated Local Scan option is enabled in the Malware Security Profile, users can right-click a USB drive in Windows Explorer and select Scan with Cortex XDR.
• On-Demand System Scan: Full system scans initiated from the Cortex XDR console can be configured to include attached removable drives.

3. Configuration Profiles
Relevant settings are located in the following profiles:

• Malware Security Profile:
  • General Settings: Enable End-user Initiated Local Scan to allow manual scanning.
  • Periodic Scan: Enable Periodic Scan and then check Scan Removable Media Drives.
• Device Control Profile:
  Used to define baseline "Allow" or "Block" actions for different USB device types and to configure specific exceptions based on hardware IDs.
• Restriction Profile:
  Can be used to restrict the execution of specific file types (like executables) directly from removable media.
  
  
  

  If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

  Thanks & Regards,
  S. Subashkar Sekar

[QuestionAb]

Thank you so much for your response @susekar 

Everything is clear now.

[susekar]

You are Welcome! @QuestionAb 

[PhilBenson]

FYI,

I achieved this by writing my own service that triggered on USB Mass Storage devices being inserted, I then looked to see if the Cortex console was active on the client, if not start it and then send the corrct message to the console that started a scan on teh inserted drive (all volumes if multiple were present).  I asked if I could put the solution on GitHub but was told no...

If would be trivial to implement by Palo but they do not seem interested.