ConnectWise Control connection getting reset

dkordyban — Tue, 03 May 2022 18:06:40 GMT

Latest spyware signatures appear to be blocking legitimate connections to ConnectWise control. The 5/2 AppThreat-8564-7375 update categorizes the connection/file (GetSessionDetails) as threat Generic PHP Webshell File Detection.

Produces "unknown error" on the ConnectWise portal page.

The only way I can get around it is to exclude the connectwise site from forward decryption. We have been using this product for years. Trying to figure out what went wrong here. Is it possible PA signature update is flawed?

Re: ConnectWise Control connection getting reset

BPry — Tue, 03 May 2022 20:19:24 GMT

@dkordyban,

There's been multiple reported issues with the new threat signatures sent out last night. I'd just roll that update back for the time being and wait for PAN to push out an update. Seems that its also triggering for some legitimate M365 traffic and some Bing traffic.

topic ConnectWise Control connection getting reset in General Topics

ConnectWise Control connection getting reset

Re: ConnectWise Control connection getting reset