topic Possible false positive C2 traffic in Advanced Threat Prevention Discussions

Possible false positive C2 traffic

MichaelWrigh — Mon, 01 Nov 2021 16:41:29 GMT

Hello,

Starting on 31st of October following the threat and content update 8480-7019, we noticed that traffic to wordpress sites ending in the URL wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js is being flagged as generic C" traffic. Checked the IP addresses and URLs on Virustotal and they are all clean.

Wondered if anyone else has been experiencing this?

Re: Possible false positive C2 traffic

rosboro — Mon, 01 Nov 2021 18:29:45 GMT

Also seeing similar hits on a few sites as of the 10/31 update.

threatid: WGeneric.atbsxx C2 traffic(385282722)

misc: <various domains>/wp-content/plugins/elementor/assets/lib/swiper/swiper.min.js?ver=5.3.6

Re: Possible false positive C2 traffic

ymiyashita — Mon, 01 Nov 2021 23:49:46 GMT

Palo Alto Networks has been working on the false positive issue with "WGeneric.atbsxx C2 traffic(385282722)". The signature will be disabled in AV version 3888.

Re: Possible false positive C2 traffic

MichaelWrigh — Tue, 02 Nov 2021 08:36:49 GMT

Thank you for the response, much appreciated.