topic Re: Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivir in Advanced Threat Prevention Discussions

Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivirus

KRisselada — Mon, 29 Jun 2020 18:27:23 GMT

Hello,
Are seeing the following in Cortex XDR
'Threat ID #348815361' generated by PAN NGFW detected on host 10.x.x.x involving user ZZZZ\first.last

Threat ID: 2418537

Current Release: 3394 (2020-06-28 UTC)

First Release: 3394 (2020-06-28 UTC)

SHA256: 1d279269b17d9282b061be59ba23a0fadecae6e44e12ea4054d4637ae736d748

Unfortunately it seems that its not at all uncommon for OneDriveSetup.exe to be flagged by PAN AntiVirus Threats as a generic W32 Virus. Seen this happen in June, also back in April. Is there a known reason why PAN A/V Threats continue to "misfire" on this?

@hisingh is this anything you have already heard or been aware of? I see you were involved in a prior discussion of this False Positive, back in April

History of this in the instance of Cortex XDR that I currently have access to from my customer. I do not have access to their Panorama or their NGFW configs, thus can not obtain capture at this time.

Re: Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivir

bit_byte — Mon, 29 Jun 2020 19:23:44 GMT

Palo alto has been release new signature Virus/Win32.WGeneric.aktpum.
Name: Virus/Win32.WGeneric.aktpum
Threat ID: 2418537
Unique Threat ID: 348815361

hash of sha-256=1d279269b17d9282b061be59ba23a0fadecae6e44e12ea4054d4637ae736d748

https://threatvault.paloaltonetworks.com/

Unique Threat ID: 348815361
We are getting Virus alerts in the Threat log for OneDriveSetup.exe .
is that false positive ?
how should I stop this threat alert ?

@KRisselada

@hisingh

@HULK

Re: Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivir

KRisselada — Mon, 29 Jun 2020 19:37:36 GMT

Hello @bit_byte if you have access to Panorama, PAN Support indicates the following can be done.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm3aCAC

In this case, I don't have access to this in the particular customer that had this occur. This was seen in Cortex XDR Incidents which Cortex is the only access we have to this customer. Hoping that PAN Threats team simply deactivates the AV Signature as soon as possible so that next daily A/V Threat update, it will be applied. In the mean time, if you have Panorama configuration access, you should be able to put in a Virus Threat exception. It seems this file triggered Virus alerts back in April also.

Re: Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivir

bit_byte — Mon, 29 Jun 2020 19:46:06 GMT

@KRisselada

We do not a panorama. We have a standalone firewall.

Re: Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivir

hisingh — Mon, 29 Jun 2020 20:55:40 GMT

Hello @bit_byte and @KRisselada

We have identified this signature and it has been disabled in WildFire, it will take about 24-48 hours till this update role into the Anti_virus package. At this time it is safe to add an exception for next 48 hours, here is link how to add exception:https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcrCAC

Best

Himani

Re: Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivir

KRisselada — Mon, 29 Jun 2020 21:23:48 GMT

Thanks for the quick reply @hisingh
Is there any review of the underlying process that seems to allow what appears to be a rather common file to be flagged like this in the last few months? Is there any known updates to reduce these sort of false positives? Its likely not a question you can answer, but I did want to ensure its out there to be seen and commented on perhaps in the future

Re: Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivir

hisingh — Mon, 29 Jun 2020 22:48:16 GMT

We are watching all and taking inputs from our customers.

Thank you for sharing this with us.

Best

Himani

Re: Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivir

mivaldi — Mon, 29 Jun 2020 22:50:00 GMT

The best way to prevent these FP's is to request the software vendor to digitally sign their binaries.

The associated sample was not signed by Microsoft.