topic Re: False positive detection in Cortex XDR Discussions

False positive detection

gdomenech — Mon, 21 Feb 2022 14:51:21 GMT

I'm representing a productivity management software manufacturer and I'm sumbitting this request to report that our software is being flagged as malware, but this result is a false positive. Please, can you help us?

File HASH: 8475477dd7cdb0493e2d5d4b3aaae39880a453dc1c212a0c14bf0ec15b4d4869
Virus total report: https://www.virustotal.com/gui/file/8475477dd7cdb0493e2d5d4b3aaae39880a453dc1c212a0c14bf0ec15b4d4869/details
VirustTotal Verdict: Generic.ml (3/69)

Re: False positive detection

eluis — Mon, 21 Feb 2022 14:58:49 GMT

Hi Gdomenech,

you can add your legit software signer as a trusted signer. Second choice will be to add that hash to the allow list.

Kr,
Luis

Re: False positive detection

gdomenech — Mon, 21 Feb 2022 15:06:07 GMT

Hi Luis,

We are not clients of Palo Alto but some of our clients are clients of yours and have the false positive detection problem. Is there a way you can fix it globally?

Thanks!

Gonzalo

Re: False positive detection

bbarmanroy — Tue, 01 Mar 2022 02:35:49 GMT

Hi @gdomenech the ideal process is to get your clients to raise a support ticket at https://support.paloaltonetworks.com/ with the details of the alert (tenant ID, alert ID, incident ID, signer, hash etc.). That'll make sure that the problem is documented and resolved though the standard channels for a global fix.

As tactical fixes, as @eluis has mentioned, your customer can allow the hash. Allowing the hash is a one-time process, and your clients might run into the same problem when a new version of the software is released. Similarly, allowing the signer is a broad-based control and I wouldn't recommend that either as a systemic fix.

Re: False positive detection

gdomenech — Tue, 22 Feb 2022 09:25:57 GMT

Thanks, We will ask our customers to raise a support ticket.