topic Spyware Detections in Advanced Threat Prevention Discussions

Spyware Detections

Sahil_Arora — Thu, 26 Oct 2023 21:05:24 GMT

Hi Community,

Lately we are noticing on one of our clients environment where PA is flagging traffic to "mail.google.com" as Spyware. The captured signature is "sliver framework command and control traffic detection".

I did run the captured URL "mail.google.com/sync/u/0/i/bv?hl=en&c=31&rt=r&pt=ji" on both, Virustotal and Palo Alto's AutoFocus. Both resulted in benign. However, we have received more then 100 alerts in last 24 hours for same signature and similar URL on our SIEM.

I wanted to know if this is a FP detection and signature has to be requested for re-classification. Anyone else experiencing similar issue?

Thanks

Re: Spyware Detections

ymiyashita — Fri, 27 Oct 2023 00:54:58 GMT

Palo Alto Networks is currently working on the false positive issue with the signature (Threat ID: 86680).
Please monitor the content release notes and look for the signature update.

Re: Spyware Detections

ymiyashita — Wed, 01 Nov 2023 01:11:42 GMT

The fix was released in content version 8774.