Microsoft Directory Services/ms-ds-smbv3 - Virus/Win32.WGeneric.yurld?

rosy876 — Tue, 04 Feb 2025 12:12:35 GMT

We are see numerous alarms from our SIEM from our Palo Alto firewall. Here is a copy of a scrubbed log message below. When asking the user about their activity, they only RDP'ed into various servers from their laptop via the Globalprotect VPN for remote admin work and ran a batch file that re-maps drives. Additionally they noted browsing to \\<dcserver>\netlogon and that it seem to take long to enumerate directory. Also full AV endpoint scans show clean. Is this s false-positive?

Re: Microsoft Directory Services/ms-ds-smbv3 - Virus/Win32.WGeneric.yurld?

kiwi — Thu, 06 Feb 2025 08:41:11 GMT

Hi @rosy876 ,

There isn't enough info here to determine FP or not.

Please gather PCAPs and open a TAC case for analysis.

Kind regards,

-Kim.

topic Microsoft Directory Services/ms-ds-smbv3 - Virus/Win32.WGeneric.yurld? in General Topics

Microsoft Directory Services/ms-ds-smbv3 - Virus/Win32.WGeneric.yurld?

Re: Microsoft Directory Services/ms-ds-smbv3 - Virus/Win32.WGeneric.yurld?