Attached images show the pop-up that is going around our network this morning. Unlike before where it would list the program Cortex blocks there is nothing there and is pointing at Microsoft for the cause.
Is this a false positive? A windows service is triggering Cortex to block the behavioral threat?
We're seeing the same here as well. End users are shown no application name, but digging through the incidents in the console shows that it's killing of Smss.exe, which is the System Center Configuration Manager agent.
All endpoints generating alerts are running 188.8.131.52725 here.
Looking through the timeline there seems to be no evidence of foul play.
Getting this too. It occurs after the latest content & policy update. I can manually trigger it but clicking check-in now button, so its like the process that applies the policy update is triggering itself lol.
You can verify this in the endpoint log on portal, it triggers same time as the policy
Support case logged also:
CASE #: 02191983
Update from my Case:
From the case description, I understand that you are receiving BTP alerts for smss.exe for the rule other.malware_gen_task.105
I would like to inform you that it is a false positive BTP alert and multiple customers where reported the same. We are working on the fix and will update you as soon as available.
As a workaround please create an alert exception for now reference.
I just created the (temporary) exception, lets see if it takes effect!
Edit: It does work. Apply the alert exception from the incident under alerts & insights, right-click the alert and select manage alert - create alert exception. It will then appear under your global BTP rules.
We are being told this is a False Positive and the Palo Support team is working on it. They say to create an exclusion in the meantime. Some general info on doing that...
This is a general Docs page. So if you are not familiar with doing this, you may need more info. This is linked info not specific to this alert.
That's all I have at the moment.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!