Cortex Pop-ups Triggered for StoreDesktopExtension.exe Despite Being Blocklisted

[J.Fernando795842]

Users are continuing to receive Cortex alert pop-ups for StoreDesktopExtension.exe even after the executable was added to the Cortex block list.

Observations:

• The file is already present in the Cortex block list.

• Alerts/pop-ups are still being triggered on user endpoints

• Is it related to Windows Security Update?
• Restarting the machine is resolving the issue. However, post that the "Windows Store App" cannot be accessed

[neelrohit]

Hi @J.Fernando795842 ,

this was a known issue where the wildfire detection engine has got updates from threat intel about specific Hash related to this application and was flagged malicious. However, this was immediately reverted and the effects on the tenant may last a few hours. Inorder to prevent business impact, you can consider adding the SHA256 to allow list for the time being and remove it later. 

Hope this helps. Please mark the response as "Accepted as Solution" if helps