About LukasB

Hello,   I have turned off alerts on NGFW for Private URL, but I still get threat ID #9999.    Can somebody a little bit more explain what this threat ID means? I am trying to clean it up, but still get these alerts. And it is not any kind of malicious traffic. It is usually connected with some internal web-pages.   I can provide more info, if needed. Lukas ... View more

Hello,  we started to have Cortex XDR alerts for *.tmp files, which refer to the C:\Windows\Install folder. e.g.  C:\Windows\Installer\MSI53B1.tmp Wildfire report says its Malware based probably on the:         Attempted to sleep for a long period | Medium Malware analysis environments have a limited amount of time in which to execute code and deliver a verdict. To subvert this process, malware often delays execution, or "sleeps," for a long period, allowing it to avoid detection. Created or modified a file in the Windows system folder | Medium The Windows system folder contains configuration files and executables that control the underlying functions of the system. Malware often modifies the contents of this folder to manipulate the system, establish persistence, and avoid detection.     Interesting thing is that this folder does not exists on any of reported machines, incl. hidden folders. Can anyone explain me a little bit more what is the folder \Install for and why we cannot see it? Does windows cleans after some patch update / bundle update, but this stays in memmory and Cortex Agent is able to dig it out?  I can report it as an incorrect verdict, but firstly would like to know.. Thank you. Lukas       Thank you. ... View more