Post detected by Wildfire

[RFeyertag]

Hello dear community, 

what means Detected (Post Detected)? 

In our case, we see pdfpower.exe incidents popping up, the user says he didn't download anything to the incident time.

I think, the agent is scanning the OS, when there is allready a quarantaine or blacklist entry?

What do you think? 

BR 

Rob

[nsinghvirk]

Hello @RFeyertag 

Detected (Post Detected) means that a particular file was earlier detected and since then its verdict has flipped from benign to malware. This happens when XDR waits for wildfire verdict for file whose's verdict is unknown and meanwhile Local Analysis has given a benign verdict, later wildfire comes with malware verdict. File was already executed and XDR generates a high severity alert with action as Detected (Post Detected).

[Kavurisowmya]

What does Prevented (Post detected) mean?

[PiyushKohli · Accepted solution]

Hi @Kavurisowmya 

"Prevented (Post Detected)" indicates that the verdict for a process has been changed to malware from benign and an agent terminated because the process was still running.

While "Detected (Post Detected)" as shared above by @nsinghvirk indicates that the verdict for a process has been changed to malware from benign and that process was executed in the past but not running anymore.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

[RFeyertag]

Thank you very much for this clarification! 

BR

Rob