topic Agcinvokerutility.exe - Adobe Utility in Next-Generation Firewall Discussions

Agcinvokerutility.exe - Adobe Utility

Sahil_Arora — Fri, 09 Feb 2024 18:46:59 GMT

Hi All,

Recently our Palo Alto flagged Agcinvokerutility.exe (Virus/Win32.Wgeneric.Eedlvy(624280308)) as malicious. A quick search on the virus signature on Virus total confirmed it to be highly malicious.

However, Agcinvokerutility.exe is also a known Adobe Utility which verifies if a valid version of adobe software is being used.

Has anyone else experienced this in their environment lately? Is it a false positive signature which PA is working on fixing it?

Re: Agcinvokerutility.exe - Adobe Utility

Claw4609 — Fri, 09 Feb 2024 19:55:47 GMT

If you believe it to be a false positive you could create an exception for it and submit a TAC case for them to remove it. However, given the VirusTotal information on that I would be extremely hesitant to exception that and would actually just recommend that you dont exception it. Just because its ran as part of a known vendor does not necessarily mean its safe.

VirusTotal - File - b807502f1a0804543488c5b85a386452d6f9848bf611db01728f3d8c23a212c9

Create Threat Exceptions (paloaltonetworks.com)