StoreDesktopExtension.exe - As Malicious

[tlmarques]

Hi,

recently i receive a lot alerts, related with StoreDesktopExtension.exe , this is usually a legitimate Microsoft Store component.

Anyone with same issue?

[Juliortega]

Hello tlmarques,

Thank you for the response.
This solution seems better suited for organizations with only a few endpoints and no users in remote locations. However, when you have more than 100 endpoints—some of them in remote areas—this approach isn’t feasible, and we end up having to open the CDM in Admin mode.
I assume we could use the live terminal to handle this instead.
For now, we’ve simply ignored the alert, and we haven’t seen any new ones since January 20.

Thanks 

[tlmarques]

Hi @Juliortega ,

In our company, we have approximately 6,000 machines. What I did was restart the agent via the tenant, and it worked.

For restart agent via tenant you can use this: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Restart-agent

[L.Filloux]

Hello,

I've been bothered with this problem too and I tried your method.
However my "cytool runtime stop" command takes too long (minutes/hours).
We have "anti-tampering" on our Agent settings so before running this command I run the command to disable protection: "cytool protect disable"
It seems like something is blocking and so our agent services cannot stop for some reasons.

If someone got the answer it will be great.
We have a ton of users and machines that suffers this False polsitive alert and I need to stop it.

Thanks for your help

[Juliortega]

Hello,

have you attempted to restart the agent—or all agents—within your tenant?

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-3.x-Documentation/Restart-agent