About zsolomon

@Stephane.B wrote: Our customer is requesting to see if the Cortex XDR protects against the GootLoader vulnerability.  Anyone have any idea? Hi Stephane,    Assuming you meant "Boot loader" since i am not familiar with " GootLoader". XDR agent will not be able to mitigate CVE-2020-10713 since it does not have Boot time protection. When thinking about it, Attacker can always replace the Boot loader with a vulnerable one so even replacing will not really be a solution.   Hope that this answers your question.   Best,  Ziv. ... View more

@service-ad wrote: Hi,   I am having this problem in a host managed by Cortex XDR , whenever I execute iexplorer.exe or outlook an xdr agent alarm is triggered indicating that it's a Memory Corruption Exploit. Except creating an Exploit profile and excluding this kind of alarm , is there any other solution , has anyone the same problem?   Process blocked: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:6220 CREDAT:18363609 /prefetch:2 Hi,    Sounds like what you need to do is retrieve and analyze, If this doesn't work, solution will be to  download the retrieve data and submit for  analysis of the issue by the Support team. They can be reached at   https://support.paloaltonetworks.com/.   I hope this helps,  ... View more

HI Carracido,    The answer will be two parts since i am not sure which one you meant: 1. In XDR Pro you can use XQL to build queries, My advice will be to either use a specific name if there is one or search for files from a specific extension. 2. Since XDR does not look into files, there is no way to know if the file is password protected.   I hope this helps.   ... View more