topic wildfire-virus threatID 602574714 false positive ? in Advanced Threat Prevention Discussions

wildfire-virus threatID 602574714 false positive ?

janekpalo — Mon, 11 Sep 2023 09:22:10 GMT

Good Morning,

Has anyone had WildFire-Virus threat events with the following threat ID:602574714 ?

Antivirus Signatures

Signature	Release	Hashes
Name: Virus/Win32.WGeneric.ebefcf Unique Threat ID: 602574714 Create Time: 2023-08-31 10:08:10 (UTC)	Threat ID: n/a Current Release: n/a First Release: n/a	21219d0038484fdd61b220f7d30b774b6216426f80fc8b2855032c5984410b65

Signature

Release

Hashes

Name: Virus/Win32.WGeneric.ebefcf

Unique Threat ID: 602574714

Create Time: 2023-08-31 10:08:10 (UTC)

Threat ID: n/a

Current Release: n/a

First Release: n/a

21219d0038484fdd61b220f7d30b774b6216426f80fc8b2855032c5984410b65

WildFire Signatures

Signature	Release	Hashes
Name: Virus/Win32.WGeneric.ebefcf Unique Threat ID: 602574714 Create Time: 2023-08-31 10:08:10 (UTC)	Threat ID: n/a Current Release: n/a First Release: 799306 (2023-08-31 UTC)	21219d0038484fdd61b220f7d30b774b6216426f80fc8b2855032c5984410b65

Signature

Release

Hashes

Name: Virus/Win32.WGeneric.ebefcf

Unique Threat ID: 602574714

Create Time: 2023-08-31 10:08:10 (UTC)

Threat ID: n/a

Current Release: n/a

First Release: 799306 (2023-08-31 UTC)

21219d0038484fdd61b220f7d30b774b6216426f80fc8b2855032c5984410b65

Since a few days we see a large number of alerts about threats detected by wildfire-virus related to traffic detected as ms-update application or web-browsing default action reset-both . Downloaded files are java script files : syntax taskpane_xxxxxxxxxxxxxxx.js, badz index_xxxxxxxxxxxxxxxxxxxxxxx.js.
The public IP addresses they connect to are mainly akamaitechnoligies.com or others, but after checking them on Virus Total or Cisco Talos they do not show any threats.
Has anyone observed similar events on the Palo Alto Firewall ?

Best Regards

Re: wildfire-virus threatID 602574714 false positive ?

ymiyashita — Tue, 12 Sep 2023 11:05:03 GMT

It was a False Positive. The signature (TID: 602574714) was already disabled.

Re: wildfire-virus threatID 602574714 false positive ?

NorcoIT — Wed, 04 Oct 2023 16:27:08 GMT

It is still live in the threat vault and our firewall is preventing updates. We don't want to add any sort of exception until we get an official response from Palo Alto that this isn't another solarwinds style situation.

Re: wildfire-virus threatID 602574714 false positive ?

NorcoIT — Wed, 04 Oct 2023 19:54:48 GMT

looks like in our version of panorama there is a bug that keeps old detections in the cache. we have resolved this

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-3-known-and-addressed-issues/pan-os-10-2-3-addressed-issues