About PierazzoD

Hi @PierazzoD,    The alert for the BTP rule mentioned above has been confirmed to be a false positive, and a fix has been implemented in content update version 510-90618. This content version was release on May 11, 2022  around 10:00 AM EST.  Please ensure that you are enable configured to receive the latest content updates by reviewing the Agent Setting Profile - Content Configuration setting applied to your endpoints. If you experience any additional operational impact, then you may raise a support case to determine next steps.  ... View more

Dear PierazzoD   " Windows cannot verify the digital signature for this file.  " log is clear indication of the problem. You can clean XDR with cleaning tool. For the getting this tool, You need to open a ticket via support portal and then you can try again to install.    Alternative solution, Required certificates are installing to certificate store when you install XDR. so You may try to DDISABLE_INTEGRITY_CHECKS with bcdedit. Try to upgrade and restore to old configs (enable integrity check). Btw, I've never tried this before and thats why I'm gonna recommend open a support request again.  ... View more

Hi @PierazzoD there are a few ways that XDR can detect it. If Cortex XDR is installed after the malware is already in the process of encrypting files (e.g., ransomware), BTP's will protect against anything deemed suspicious/malicious, including ransomware-related activities. To ensure complete protection, it is recommended to restart the host after a successful agent installation and ensure the security profiles are configured and applied appropriately.   Ref: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-security-profiles/add-malware-security-profile.html     ... View more