Scaning files for malware

[Sedlacek]

Is it possible to use Cortex XDR to analyse malicious Microsoft Office files, such as Word, Excel and PowerPoint documents? If I right click on Office file and choose Scan with Cortex XDR will Cortex check if that file is not used for delivering malware, including binary files, documents, scripts, archives a macros? 

[aspatil]

Hello @Sedlacek ,

Thank you for writing to Live Community.

I hope below article will answer your query:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Pr...

Please mark the response as "Accept as Solution" if it answers your query.

Regards.

[aleksandar.astardzhiev]

Hi @Sedlacek ,

So XDR applies so called "pre-execution" protections, where it analyzes the file when user tries to open/execute it, but before it is being allowed to run XDR do its checks.

File Scan, where it is on-demand (right click on file and scan now) or scheduled scan, essentially perform same checks on the file, but without the need for the user to open the file.

What it means is that, you may download malicious file, but if you don't scan it (manually or scheduled) and you never open it, XDR will never know that it is malicious. But if you open it it will be inspected. Same check will apply if you first scann it before open it.

Below picture indicates which checks will XDR apply when scaning a file. Those that are grayed out are done when file is opened, but not when file is being scanned.