We often see in the infrastructure that the user tries to download/move a malicious file from a flash drive to the desktop several times in a row, but the file quarantine does not always occur. That is, for 5 successful quarantines, there may be 1 failed. And at this point, we see the Cloud IOC event: ExecutedMalware.ioc. After this, the PC may immediately be automatically isolated. Unfortunately, it is not possible to reproduce the situation, since all quarantines from the test environment are fast and successful.
My question: How does this happen? That is, the user downloads the file several times, waits until the Cisco SE agent does not work for quarantine and launches the file before it was quarantined? Does launching such a malicious file really affect the OS in that short period before the moment of isolation? Do I need to reinstall the OS after this?
