Set up malware prevention profiles - Administrator Guide - Cortex XDR - Cortex - Security Operations

Action Mode

When the Cortex XDR agent detects attempts to run malware, it performs the configured action.

Quarantine Malicious Executables

By default, the Cortex XDR agent blocks malware from running, but does not quarantine the file. You can enable one of the options to quarantine files, depending on the verdict issuer.

Action when file is unknown to WildFire

Allow: Unknown files are not blocked and local verdicts are not issued for them.

Run Local Analysis: The Cortex XDR agent uses embedded machine learning to determine the likelihood that an unknown file is malware, and issues a local verdict for the file.

Block: Block unknown files but do not run local analysis. In this case, unknown files remain blocked until the Cortex XDR agent receives an official WildFire verdict.

Action when file is benign with low confidence

Select the action to take when a file with a Benign Low Confidence verdict from WildFire tries to run on the endpoint. When local analysis is enabled, the Cortex XDR agent uses embedded machine learning to determine the likelihood that an unknown file is malware, and issues a local verdict for the file. If you block this file but do not run a local analysis, the file remains blocked until the Cortex XDR agent receives a high-confidence WildFire verdict.

To enable this capability, ensure that WildFire analysis scoring is also enabled in Global Agent Settings.

Upload unknown files to WildFire

When enabled, the Cortex XDR agent sends unknown files to Cortex XDR, and Cortex XDR sends the files to WildFire for analysis.

The file types that the Cortex XDR agent analyzes depend on the platform type. WildFire accepts files up to 100 MB in size.

Treat Grayware as Malware

When enabled, Cortex XDR treats all grayware with the same Action Mode as configured for malware.

When disabled, grayware is considered benign, and is not blocked.

Action Mode

When the Cortex XDR agent detects attempts to run malware, it performs the configured action.

Action when file is unknown to WildFire

Select the action to take when a file is not recognized by WildFire. When local analysis is enabled, the Cortex XDR agent uses embedded machine learning to determine the likelihood that an unknown file is malware, and issues a local verdict for the file.

If you block unknown files, but do not run local analysis, unknown files remain blocked until the Cortex XDR agent receives an official WildFire verdict.

Action when WildFire verdict is Benign Low Confidence

Select the action to take when a file with a Benign Low Confidence verdict from WildFire tries to run on the endpoint. When local analysis is enabled, the Cortex XDR agent uses embedded machine learning to determine the likelihood that an unknown file is malware, and issues a local verdict for the file.

If you block this file but do not run a local analysis, the file remains blocked until the Cortex XDR agent receives a high-confidence WildFire verdict.

To enable this capability, ensure that WildFire analysis scoring is also enabled in Global Agent Settings.

Upload unknown files to WildFire

When enabled, the Cortex XDR agent sends unknown files to Cortex XDR, and Cortex XDR sends the files to WildFire for analysis. For macro analysis, the Cortex XDR agent sends the Microsoft Office file containing the macro.

The file types that the Cortex XDR agent analyzes depend on the platform type. WildFire accepts files up to 100 MB in size.

Examine Office files from network drives

You can enable the Cortex XDR agent to examine Microsoft Office files on network drives when they contain a macro that attempts to run.

Action Mode

When enabled, the Cortex XDR agent monitors for malicious files during the on-write process, and if finds any, it sends alerts and quarantines the files.

End-User Initiated Local Scan

When enabled, the endpoint user can perform a local scan on the endpoint.

Periodic Scan

Periodic scanning enables you to scan endpoints on a recurring basis without waiting for malware to run on the endpoint. When enabled, you can set the time interval (weekly or monthly) and the day and time at which to start scanning. In addition, you can choose to enable or disable scanning of removable media drives.

Periodic scanning is persistent, and if the scan is scheduled to start while the endpoint is turned off, the scan will be initiated when the endpoint is turned on again. The scheduling of future scans is not affected by this delay.

Action Mode

The Cortex XDR agent protects against malicious causality chains, using behavioral threat protection rules. When the action mode is set to Block, the Cortex XDR agent terminates all processes and threads in the event chain up to the causality group owner (CGO).

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes and the artifacts, such as files, related to the CGO.

When disabled, the Cortex XDR agent does not quarantine the CGO of an event chain, nor any scripts or files called by the CGO.

Action Mode for Vulnerable Drivers Protection

Behavioral threat protection rules can also detect attempts to load vulnerable drivers which can be used to bypass the Cortex XDR agent. As with other rules, Palo Alto Networks threat researchers can deliver changes to vulnerable driver rules with content updates.

Advanced API Monitoring

When enabled, the Cortex XDR agent adds additional hooks in user mode processes for increased coverage of anti-exploit and anti-malware modules.

Action Mode

The Cortex XDR agent protects against all processes and threads in the event chain up to the credential gathering process or file.

When this module is disabled, the Cortex XDR agent does not analyze the event chain and does not block credential gathering.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the process or file related to the credential gathering event chain.

Action Mode

In a causality chain, when the Cortex XDR agent detects a process that attempts to drop malicious web shells, it performs the configured action.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes or files that are related to the web shell drop event chain, and any scripts or files called by the web shell dropping process.

Action Mode

In a causality chain, when the Cortex XDR agent detects a process that attempts to access or steal financial or banking information, the Cortex XDR agent performs the configured action.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes or files related to the financial information gathering event chain, and scripts or files called by the financial information gathering process.

Action Mode

In a causality chain, when the Cortex XDR agent detects a cryptomining process or file, the Cortex XDR agent performs the configured action.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the process or file detected during a cryptocurrency gathering attempt.

Action Mode

In a causality chain, when the Cortex XDR agent detects a process that attempts to run in-process shellcodes to load malicious code, the Cortex XDR agent performs the configured action.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the in-process shellcode processes or files related to a causality chain.

Action Mode

When the Cortex XDR agent detects the connection of potentially malicious external device to an endpoint, the Cortex XDR agent performs the configured action.

Action Mode

When the Cortex XDR agent detects a UAC bypass mechanism, the Cortex XDR agent performs the configured action. The Block option blocks all processes and threads in the event chain up to the UAC bypass mechanism.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the UAC bypass processes or files related to the chain, and any scripts or files released to the UAC bypass mechanism.

Action Mode

When the Cortex XDR agent detects a tampering attempt, including modification and/or termination of the Cortex XDR agent, it performs the configured action.

If you choose the Block option, you must also enable XDR Agent Tampering Protection in the Agent Settings profile, and ensure that both profiles are assigned to the same endpoints.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes or files that are related to the tampering attempt.

Action Mode

When the Cortex XDR agent detects a threat that targets an Internet Information Server (IIS), the Cortex XDR agent performs the configured action.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes or files that are related to the IIS attack.

Action Mode

When the Cortex XDR agent detects UEFI manipulation attempts, it performs the configured action. When Block is selected, the Cortex XDR agent blocks all processes and threads in the event chain, up to the UEFI threat.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes or files that are related to the UEFI threat.

Action Mode

When the Cortex XDR agent detects ransomware activity locally on the endpoint or in pre-defined network folders, the Cortex XDR agent performs the configured action.

Quarantine Malicious Process

When enabled, the Cortex XDR agent quarantines the processes that are related to the ransomware activity.

The Quarantine Malicious Process option is only available if Action Mode is set to Block.

Action Mode

When the Cortex XDR agent detects known suspicious parent-child relationships that are used to bypass security, the Cortex XDR agent performs the configured action. When Block is selected, known suspicious child processes are blocked from starting.

Terminate Connection and Block IP Address of Remote Causality Group Owner

When the Cortex XDR agent identifies a remote network connection that attempts to perform malicious activity—such as encrypting endpoint files—the agent can automatically block the IP address to close all existing communication, and to block new connections from this IP address to the endpoint. When Cortex XDR blocks an IP address per endpoint, that address remains blocked throughout all agent profiles and policies, including any host-firewall policy rules. You can view the list of all blocked IP addresses per endpoint from the Action Center, as well as unblock them to re-enable communication as appropriate.

Action Mode

By analyzing the network packet data, the Cortex XDR agent can already detect malicious behavior at the network level, and provide protection to the growing corporate network boundaries. The engine leverages both Palo Alto Networks NGFW content rules, and new Cortex XDR content rules created by the Cortex XDR Research Team. The Cortex XDR content rules are updated through the security content. This feature focuses on detecting outbound C2 activity.

The Terminate session option configures Cortex XDR agents to analyze connections and to drop the malicious connections.

The Report option configures XDR agents to analyze connections, to allow the transmission of packets in your network, but to report them to Cortex XDR.

Action Mode

When set to Block, this protection module loads during the boot process to protect the endpoint against malicious processes running at boot time.

Periodic Scan

Periodic scanning enables you to scan endpoints on a recurring basis without waiting for malware to run on the endpoint. When enabled, you can set the time interval (weekly or monthly) and the day and time at which to start scanning. In addition, you can choose to enable or disable scanning of removable media drives.

Periodic scanning is persistent, and if the scan is scheduled to start while the endpoint is turned off, the scan will be initiated when the endpoint is turned on again. The scheduling of future scans is not affected by this delay.

Action Mode

The Cortex XDR agent protects against malicious causality chains, using behavioral threat protection rules. When the action mode is set to Block, the Cortex XDR agent terminates all processes and threads in the event chain up to the causality group owner (CGO).

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes and the artifacts, such as files, related to the CGO.

When disabled, the Cortex XDR agent does not quarantine the CGO of an event chain, nor any scripts or files called by the CGO.

Action Mode

The Cortex XDR agent protects against all processes and threads in the event chain up to the credential gathering process or file.

When this module is disabled, the Cortex XDR agent does not analyze the event chain and does not block credential gathering.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the process or file related to the credential gathering event chain.

Action Mode

In a causality chain, when the Cortex XDR agent detects a process that attempts to drop malicious web shells, it performs the configured action.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes or files that are related to the web shell drop event chain, and any scripts or files called by the web shell dropping process.

Action Mode

In a causality chain, when the Cortex XDR agent detects a process that attempts to access or steal financial or banking information, the Cortex XDR agent performs the configured action.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes or files related to the financial information gathering event chain, and scripts or files called by the financial information gathering process.

Action Mode

In a causality chain, when the Cortex XDR agent detects a cryptomining process or file, the Cortex XDR agent performs the configured action.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the process or file detected during a cryptocurrency gathering attempt.

Action Mode

When the Cortex XDR agent detects a tampering attempt, including modification and/or termination of the Cortex XDR agent, it performs the configured action.

If you choose the Block option, you must also enable XDR Agent Tampering Protection in the Agent Settings profile, and ensure that both profiles are assigned to the same endpoints.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes or files that are related to the tampering attempt.

Action Mode

When the Cortex XDR agent detects ransomware activity locally on the endpoint or in pre-defined network folders, the Cortex XDR agent performs the configured action.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the files that are related to the ransomware activity.

Action Mode

When the Cortex XDR agent detects known suspicious parent-child relationships that are used to bypass security, the Cortex XDR agent performs the configured action. When Block is selected, known suspicious child processes are blocked from starting.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the files that are related to a malicious child process.

Action Mode

When the Cortex XDR agent detects attempts to run malware, it performs the configured action.

Quarantine malicious Mach-O files

By default, the Cortex XDR agent blocks malware from running, but does not quarantine the file. You can enable one of the options to quarantine files, depending on the verdict issuer.

Action Mode

When enabled, the Local Threat-Evaluation Engine (LTEE) analyzes the endpoint for PHP files arriving from a web server and alerts about any malicious PHP scripts.

Terminate Malicious Processes

When enabled, the Cortex XDR agents terminates malicious PHP files on the endpoint.

Action Mode

When the Cortex XDR agent detects attempts to run malware in DMG files, it performs the configured action.

Quarantine Malicious Executables

When enabled, the Cortex XDR agent quarantines malicious executable DMG files.

Periodic Scan

Periodic scanning enables you to scan endpoints on a recurring basis without waiting for malware to run on the endpoint. When enabled, you can set the time interval (weekly or monthly) and the day and time at which to start scanning.

Periodic scanning is persistent, and if the scan is scheduled to start while the endpoint is turned off, the scan will be initiated when the endpoint is turned on again. The scheduling of future scans is not affected by this delay.

Scan Timeout

Number of hours

If a scan exceeds the number of hours configured here, the Cortex XDR agent stops the scan.

Action Mode

The Cortex XDR agent protects against malicious causality chains, using behavioral threat protection rules. When the action mode is set to Block, the Cortex XDR agent terminates all processes and threads in the event chain up to the causality group owner (CGO).

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes and the artifacts, such as files, related to the CGO.

When disabled, the Cortex XDR agent does not quarantine the CGO of an event chain, nor any scripts or files called by the CGO.

Action Mode

The Cortex XDR agent protects against all processes and threads in the event chain up to the credential gathering process or file.

When this module is disabled, the Cortex XDR agent does not analyze the event chain and does not block credential gathering.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the process or file related to the credential gathering event chain.

Action Mode

In a causality chain, when the Cortex XDR agent detects a process that attempts to drop malicious web shells, it performs the configured action.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the processes or files that are related to the web shell drop event chain, and any scripts or files called by the web shell dropping process.

Action Mode

In a causality chain, when the Cortex XDR agent detects a process that attempts to access or steal financial or banking information, the Cortex XDR agent performs the configured action.

Quarantine Malicious Files

In a causality chain, when the Cortex XDR agent detects a process that attempts to access or steal financial or banking information, the Cortex XDR agent performs the configured action.

Quarantine Malicious Files

When enabled, the Cortex XDR agent quarantines the process or file detected during a cryptocurrency gathering attempt.

Action Mode

When the Cortex XDR agent detects container escaping attempts, it performs the configured action.

Action Mode

When the Cortex XDR agent detects attempts to run malware in ELF files, it performs the configured action.

Quarantine malicious ELF files

By default, the Cortex XDR agent blocks malware from running, but does not quarantine the file. You can enable one of the options to quarantine files, depending on the verdict issuer.

Action Mode

When enabled, the Local Threat-Evaluation Engine (LTEE) analyzes the endpoint for PHP files arriving from a web server and alerts about any malicious PHP scripts.

Action Mode

When the Cortex XDR agent detects attempts to redirect standard input and output streams to network sockets, it performs the configured action.

Action Mode

When the Cortex XDR agent detects attempts to run malicious APK files, it performs the configured action.

Action on unknown APK files to WildFire

Allow: Unknown files are not blocked and local verdicts are not issued for them.

Run Local Analysis: The Cortex XDR agent uses embedded machine learning to determine the likelihood that an unknown file is malware, and issues a local verdict for the file.

Block: Block unknown files but do not run local analysis. In this case, unknown files remain blocked until the Cortex XDR agent receives an official WildFire verdict.

Upload APK files for cloud analysis

When enabled, the Cortex XDR agent sends unknown files to Cortex XDR, and Cortex XDR sends the files to WildFire for analysis.

The file types that the Cortex XDR agent analyzes depend on the platform type. WildFire accepts files up to 100 MB in size.

Treat Grayware as Malware

When enabled, Cortex XDR treats all grayware with the same Action Mode as configured for malware.

When enabled, Cortex XDR treats all grayware with the same Action Mode as configured for malware.