topic PA firewall treated NBSS Continuation Message as Worm/Win32.vobfus in Next-Generation Firewall Discussions

PA firewall treated NBSS Continuation Message as Worm/Win32.vobfus

MarcusLeung — Wed, 31 Aug 2022 03:28:22 GMT

Hi all,

Recently the PA firewall received massive threat alert with family Worm/Win32.vobfus.

(Application: ms-ds-smbv3, Port: 445, thr_category: pe)

I have submitted the file samples and the files are clean, we also scan the server and there is no virus.

Which we confirm this alert is a false positive.

Then I take a Threat Packet Capture, PA firewall captures the NBSS Continuation Message.

I see the TCP payload is all zero, it that the reason PA treated the NBSS Continuation Message as Worm/Win32.vobfus?

Please help, thank you!

Regards,

Marcus

Re: PA firewall treated NBSS Continuation Message as Worm/Win32.vobfus

nikoolayy1 — Wed, 31 Aug 2022 19:59:49 GMT

Well just make a new security rule that matches the source and destination with a new antivirus profilewhere the antivirus signature is dissabled and place is before the current rule that is triggering the false positive.

Worm/Win32.vobfus:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPQgCAO&lang=en_US%E2%80%A9&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Exceptions:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcrCAC

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat-prevention/create-threat-exceptions