How to Effectively Restrict Specific Files Across All Locations in Cortex XDR?

[J.X570892]

I am facing a challenge in Cortex XDR regarding file restrictions. When we need to block a specific file on endpoints, we add its file path to the restriction profile. This effectively blocks users from accessing or opening the file in the specified location.

However, the issue arises when a user copies the restricted file and pastes it into a different location. In this new location, they can access and open the file without any restrictions.

Is there a way to ensure that such files are blocked universally, regardless of their location on the endpoint? Any insights or best practices to address this scenario would be greatly appreciated.

[mavega]

Hi,

Thanks for reaching Live Community.

If you want to block a specific file from all your endpoint, I believe the best option is to add the hash in the block list.

You can review this here:  https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Manage-File...

If this post answers your question, please mark it as solution.

[RFeyertag]

Is blocking the best way? What about alerting, if a user reads or moves it? And if, than...

BR

Rob

[maximk]

If it's digitally signed, I would block by the signer via Restriction profile. Otherwise by sha256 via blocklist.    

[VarunPitale]

Can you add it as a fileName as well as hash value in the IOC and then add that IOC to the Restriction Profile?