Possible false-positive spike: Threat ID 99951 Inline Cloud Analyzed CMD Injection Traffic Detection

[J.Smith958349]

Hi all,

Is anyone else seeing a recent spike in the following Advanced Threat Prevention / Inline Cloud Analysis alert?

Threat ID: 99951
Threat Name: Inline Cloud Analyzed CMD Injection Traffic Detection
Threat Type: Vulnerability
Severity: High
Threat Category: inline-cloud-exploit

We started seeing a sharp increase in this detection shortly after what appears to have been a Palo Alto cloud-side update/rollout. The increase happened within the same day and does not match our normal baseline.

The alerts are mostly associated with normal outbound user web traffic to common public SaaS, cloud, CDN, and marketing/tracking domains. We are not seeing an obvious endpoint-side indicator that would explain a real command-injection pattern across the affected hosts/users.

TAC suggested increasing the Inline Cloud Analysis Max Latency setting from the default 200 ms to 1000 ms. We changed it to 800 ms as a test, but it has not reduced the volume.

What we are trying to determine:

1. Is anyone else seeing a recent increase in Threat ID 99951?
2. Did anyone observe this starting after a recent cloud-side Advanced Threat Prevention / Inline Cloud Analysis update?
3. Has Palo confirmed any false-positive activity or detection-model issue for this threat ID?
4. Did changing Inline Cloud Analysis Max Latency help anyone, or did the alerts continue?
5. Has anyone received a better mitigation from TAC besides increasing latency?

We are not looking to disable Inline Cloud Analysis globally. At this point we are trying to confirm whether this is a localized issue, a broader cloud-model false-positive condition, or something specific to our configuration.

Any feedback from others seeing similar behavior would be appreciated.

Event details:

Threat ID: 99951
Threat Name: Inline Cloud Analyzed CMD Injection Traffic Detection
Severity: High
Type: Vulnerability
Category: inline-cloud-exploit
Direction: outbound client web traffic
Pattern: sudden spike across multiple users/hosts
Destinations: common public SaaS/cloud/CDN/marketing domains
Latency setting before: 200 ms
Latency setting tested: 800 ms
Result: no noticeable reduction in alert volume