topic Re: False positives generated by alert Masquerading - 1396383840 in General Topics

False positives generated by alert Masquerading - 1396383840

fhudsmith — Wed, 14 Jun 2023 11:20:37 GMT

Hi,

Is anyone else experiencing lots of false positives for the BIOC - Masquerading - 1396383840, specifically relating to signed Microsoft system 32 files and Chrome?

The files initiating the alerts are all signed, have not been modified for a long time and I cannot see any malicious behaviour.

Re: False positives generated by alert Masquerading - 1396383840

Sanath_Suvarna — Wed, 14 Jun 2023 11:28:48 GMT

yeah me too i dont know the cause

Re: False positives generated by alert Masquerading - 1396383840

fhudsmith — Wed, 14 Jun 2023 11:32:51 GMT

Hmm, I'm thinking this may be some misconfig on PaloAlto side. They had a similar incident a couple of months ago which created lots of alerts for TOR exit nodes which was also false positives.

Re: False positives generated by alert Masquerading - 1396383840

SorinVargaE — Mon, 19 Jun 2023 10:04:34 GMT

Hi,

We are also experiencing the same problem with Masquerading alerts.

It might trigger in certain conditions and it could be related to the latest CU 980 where they made some changes to BTP agent module.