Local Analysis and Exceptions

[J.Motz]

Hey,
we are struggling with the following Case with understanding local Analysis, Macros and writing a useful exceptions.

Local Analysis is alerting on a WinWord.exe with "Macro(s) in Winword.exe". The Macro is only mentioned by hash.

Exception with Disable Prevention Rules for local analysis on the macro hashes are not working, similarly on Winword.exe itself. 

All Files are accessed on a share drive.

Now, our Problem is that we ideally want to just exclude the macro hash somehow. But since this doesn´t work what is the alternative? 
Excluding the whole Path seems to excessive. 
Maybe reducing some "Parameters" that influence the local analysis to get the analysis score down. 
Or is there some other simple or alternative solution we did not think of.

Thank you in advance for your response.

[susekar]

Hello @J.Motz ,

Greetings for the day.

Why Standard Hash Exclusions and Disable Prevention Rules (DPR) Fail:

When Microsoft Word executes macros, it frequently creates temporary files (such as ~WRD0001.tmp, .asd files, or Normal.dotm) with randomized filenames and dynamically changing hashes.

As a result, standard hash-based exclusions are often ineffective because each newly generated file may have a different hash value, preventing the exclusion from consistently matching the file.

Additionally, Disable Prevention Rules (DPR) are reactive in nature. They are applied during a later stage of the evaluation process to prevent remediation actions such as file quarantine or process termination. However, DPRs do not prevent security modules, such as Local Analysis, from inspecting and evaluating the files.

Because of this behavior, applying a DPR to WinWord.exe or to the macro file hash itself may not prevent the file from being analyzed and can still result in application delays, freezes, or blocking behavior during the inspection process.

Option 1 - Feature Vector Hash (fvHash) Support Exceptions (SUEX)

-Contact PaloAlto Cortex XDR TAC support.

Option 2: Proactive Legacy Agent Exceptions with Granular Wildcards

Unlike reactive DPRs, Legacy Agent Exceptions are proactive and instruct the agent to completely bypass scanning of the specified file or path, helping to eliminate both blocking and application freezes.

Instead of excluding the entire network share, configure a Legacy Agent Exception targeting the specific module and use narrow path wildcards to limit the scope of the exclusion.

1. In the Cortex XDR console, navigate to Settings > Exception Configurations > Legacy Agent Exceptions.
2. Click + Add Rule.
3. Set the Platform to Windows.
4. Set the Module to Office Files and Macros Examination (or Portable Executable and DLL Examination if DLLs are being generated).
5. Define the folder structure on the network share using wildcard patterns to target only the required macro files.

Examples:

• Targeting macro-enabled Word templates: \\your-share\folder\*\*.dotm

• Targeting specific filename patterns:\\your-share\folder\~*.tmp

Important: If excluding a specific directory structure on the share, ensure the path ends with a wildcard (*) so that all dynamically generated files and subfolders are covered.

Example: \\your-share\specificmacrofolder\*'

Option 3: Digitally Sign the Macros:

A more robust and security-aligned approach is to digitally sign the macros using a trusted enterprise code-signing certificate.

1. Ensure the certificate is deployed and trusted on all relevant endpoints.
2. In the Cortex XDR console, edit the active Malware Security Profile.
3. Under the Signer Allow List, add the signer or publisher certificate name.

This allows signed macro files to execute without relying on path-based exclusions or constantly changing file hashes.

Option 4: Targeted Policy Adjustments (Module Disablement):

If macro development or execution is limited to a specific group of systems (such as VDI hosts, Citrix servers, or designated business units), consider creating a dedicated policy.

1. Navigate to Policy Management > Profiles > Malware Profiles.
2. Duplicate an existing profile or create a new one (for example, Citrix_WinWord_Allow_Macros).
3. Locate the Office Files and Macros Examination module.
4. Set the action to Allow or Disabled, depending on the requirement.
5. Create a corresponding Prevention Rule and assign the customized Malware Profile only to the approved endpoints or server groups.
   

This approach enables macro execution where required while maintaining stricter protection policies across the rest of the environment.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar