On-write file examination / cross-platform examination for Linux

[andreal]

Dear LIVEcommunity

Has anyone been able to test out the new Linux / MacOS cross-platform examination module? I created a new Linux Malware Profile and set the "On-write File Examination" for "Portable executable files (Windows)" to Enabled, applied it to a policy for my Linux endpoint, waited for the policy to apply and then copied a WildFire Test PE (Windows executable which should always trigger an alert) from a Windows to my Linux host via WinSCP. I did not get any Cortex XDR Alerts, and a manually initiated Cortex XDR malware scan on the Linux endpoint also did not detect the file. The Linux host has Cortex XDR Agent 9.1.0, the feature should be supported with version 8.9+

A closer inspection of the "wf_verdicts.db" shows my WildFire Test PE Windows Executable has a Verdict with value 6, which I cannot find in the Log Format documentation (only values 0,1,2,4,99 are defined): https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Documentation/Log-formats 

I'm curious to see if anyone was able to successfully test this feature. 

[susekar]

Hello @andreal ,

Greetings for the day.

In the local wf_verdicts.db SQLite database for Cortex XDR agents (including Linux and macOS), the verdict value '6' technically maps to UnsupportedFileType .

WinSCP (using SFTP/SCP protocols) is considered a high-volume I/O process that can trigger the "noisy process" protection mechanism (LRU throttling) in Cortex XDR Agent 9.1.0 for Linux, potentially causing "On-Write File Examination" to be bypassed.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[andreal]

Hello @susekar 

I appreciate the quick response! Thanks for the insight in to the verdict value 6, very interesting. 

As the filetype is not supported, I upgraded to Cortex XDR Agent Version to 9.2.0 (because it's a feature from the latest release - I assume the on-write-protection is a feature for Cortex XDR Agent 8.9+ but cross-platform-examination only a 9.2.0 feature) and tried to re-produce the issue. Again, no alert was created. 

However, now the verdict value changed to '3' for the new file. 

Is there any other protocol I could use to test out the cross-platform-examination if WinSCP is bypassing the "On-Write File Examination"?