Suspecting XDR Agent Blocking Sysprep Process Randomly

[kpatel35ntt]

We have noticed random block of sysprep process and ending up corrupting image. Has anyone noticed this?

[eluis]

Hi Kpatel35ntt,

It seems to me that this random block of sysprep has to do with our detection thinking that a legit process is maybe used in a suspicious way. 

I see this have to be investigated further, so I would recommed to open a TAC support case, to figure out the root cause of false positives on sysprep behavior 

A temporal solution would be to create a legacy exception on that process/path/hash... the more you narrow down, the better

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR,

Luis

[micomi · Accepted solution]

Check this knowledge base article: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000blZlKAI

Could be the issue you have.

Hope this helps

[kpatel35ntt]

Palo TAC  Support Feedback was to go with File Protection disable under Agent Security Settings. Test with updated version would help to remove unnecessary profiles.