Unable to download a from from an endpoint - File size limit exceeded

[Arman_Zaheri]

Hello Cortex geeks,

I have a problem with a large file on an endpoint. This file is relatively large (1.1GB), has no VT ranking as it's too large for it obviously, and Cortex alerted about it because of signature forgery. I want to download and examine the file to make sure, but Cortex does not allow downloading it. What is a good best practice here to check the file to digital signature or even scan it using other vendors.

BR,

[susekar]

Hello @Arman_Zaheri ,

Greetings for the day.

To analyze a large file (1.1GB) that has triggered a signature forgery alert and cannot be downloaded via the Cortex XDR console, you should perform local verification on the endpoint itself. Cortex XDR has specific limitations regarding large files, notably that it does not provide an analysis verdict for files larger than 100MB, treating them as unknown or unsupported.

1. Verify the Digital Signature Locally

Since you cannot retrieve the file due to size constraints, use the following methods on the affected endpoint to examine the signature:

• Manual Inspection:
  1. Locate the file in Windows Explorer.
  2. Right-click the file and select Properties.
  3. Navigate to the Digital Signatures tab.
  4. Select the signature and click Details to review the certificate chain and validity dates. An expired or invalid certificate can often trigger signature-related alerts.
• Use Sigcheck Utility:
  The sigcheck.exe tool (from Microsoft Sysinternals) is the recommended best practice for debugging internal Windows certificate validation failures that Cortex XDR relies on.
  • Run sigcheck -i <path_to_file> to see detailed certificate chain information.
  • This is particularly useful when the OS fails to verify the certificate chain (e.g., unreachable CRL or missing Root CA), causing the agent to treat the file as unsigned or forged.

2. Scanning and Analysis Best Practices

Because the file exceeds the 650MB limit for many automated sandbox environments and the 100MB limit for standard Cortex XDR verdict analysis, follow these steps:

• Understand the "Signature Forgery" Alert: Cortex XDR may flag a file if it has a fake signature or if there are functional defects in obtaining the digital signature. Cortex XDR often has access to local Windows catalog files for verification that cloud-based platforms (like VirusTotal) do not.
• Hash-Based Lookups: Even if the file is too large for VT's file upload, you can check the file's SHA256 hash on VirusTotal. If the file has been seen before by any vendor, the hash record will exist.
• Manual Scanning: Use the cytool utility on the endpoint to force a local scan, which will utilize the local analysis engine and perform a cloud lookup for the hash:
  

  "C:\Program Files\Palo Alto Networks\Traps\cytool.exe" scan file "C:\path\to\your\largefile.ext"
  

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Happy New year!!

Thanks & Regards,
S. Subashkar Sekar