topic Microsoft Directory Services/ms-ds-smbv3 - Virus/Win32.WGeneric.yurld? in Advanced Threat Prevention Discussions

Microsoft Directory Services/ms-ds-smbv3 - Virus/Win32.WGeneric.yurld?

NiganDong — Tue, 05 May 2020 08:19:42 GMT

We are see numerous alarms from our SIEM from our Palo Alto firewall. Here is a copy of a scrubbed log message below. When asking the user about their activity, they only RDP'ed into various servers from their laptop via the Globalprotect VPN for remote admin work and ran a batch file that re-maps drives. Additionally they noted browsing to \\<dcserver>\netlogon and that it seem to take long to enumerate directory. Also full AV endpoint scans show clean. Is this s false-positive?

Re: Microsoft Directory Services/ms-ds-smbv3 - Virus/Win32.WGeneric.yurld?

mivaldi — Wed, 06 May 2020 23:22:22 GMT

Yes, that signature was disabled on 03/22/2019 14:30 PDT.

You must be running an outdated Antivirus or WildFire-Virus package.

Please review what versions you're running and make sure your Dynamic Updates scheduler is properly set and that the firewall can reach updates.paloaltonetworks.com.

Re: Microsoft Directory Services/ms-ds-smbv3 - Virus/Win32.WGeneric.yurld?

TerenceOyape — Mon, 10 Aug 2020 17:46:28 GMT

Did you get a resolution to this? We are experiencing a similar situation where ms-ds-smbv3 signature is being identified as a virus. We have all up to date Dynamic Content as well.