Threat ID 58644 false positives

Adrian_Jensen — Thu, 05 Aug 2021 22:00:48 GMT

For the past couple weeks we have seen apparent false alerts for Threat ID 58644. The Threat Vault references that this ID is for detection of a PHP shell injection vulnerability in RiteCMS, CVE-202-23934, which was first released 7/28/2020 and last updated 7/20/2021. Since 7/21 we have had repeated alerts under this Threat ID for images and video at Giphy.com, specifically for files giphy.gif, giphy-preview.gif, giphy_s.gif, and giphy.mp4. These are from URLs like:

https://media1.giphy.com/media/<alphanum>/giphy.gif?cid=<alphanum>&rid=giphy.gif&ct=g

All have scanned as benign and appear to be GIFs inserted into chats and discussions from various sources. Is anyone else seeing this and can confirm?

topic Threat ID 58644 false positives in Advanced Threat Prevention Discussions

Threat ID 58644 false positives