https://live.paloaltonetworks.com/t5/general-topics/cobaltstrike-gen-command-and-control-traffic-18005/m-p/423510#M94180 <P>Hi <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/189190">@Nthomas</a>&nbsp;</P><P>If you don't get any replies about false positive reportings, then try to ask support.</P><P>(Unfortunately) the strings/signatures used are kept secret by paloalto. If you have a packet capture then you might be able to reverse engineer it ...</P> Fri, 30 Jul 2021 18:12:30 GMT Remo 2021-07-30T18:12:30Z https://live.paloaltonetworks.com/t5/general-topics/cobaltstrike-gen-command-and-control-traffic-18005/m-p/423431#M94162 <P>Hi Team,</P><P>&nbsp;</P><P>Just want to enquire if this particular&nbsp;signature marked as "Critical" severity has any False positive reporting ?</P><P>Interested to know what are the strings used&nbsp;&nbsp;</P><P>&nbsp;</P> Fri, 30 Jul 2021 17:23:33 GMT https://live.paloaltonetworks.com/t5/general-topics/cobaltstrike-gen-command-and-control-traffic-18005/m-p/423431#M94162 Nthomas 2021-07-30T17:23:33Z https://live.paloaltonetworks.com/t5/general-topics/cobaltstrike-gen-command-and-control-traffic-18005/m-p/423510#M94180 <P>Hi <a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/189190">@Nthomas</a>&nbsp;</P><P>If you don't get any replies about false positive reportings, then try to ask support.</P><P>(Unfortunately) the strings/signatures used are kept secret by paloalto. If you have a packet capture then you might be able to reverse engineer it ...</P> Fri, 30 Jul 2021 18:12:30 GMT https://live.paloaltonetworks.com/t5/general-topics/cobaltstrike-gen-command-and-control-traffic-18005/m-p/423510#M94180 Remo 2021-07-30T18:12:30Z