False positive detection

[gdomenech]

I'm representing a productivity management software manufacturer and I'm sumbitting this request  to report that our software is being flagged as malware, but this result is a false positive. Please, can you help us?

• File HASH: 8475477dd7cdb0493e2d5d4b3aaae39880a453dc1c212a0c14bf0ec15b4d4869
• Virus total report: https://www.virustotal.com/gui/file/8475477dd7cdb0493e2d5d4b3aaae39880a453dc1c212a0c14bf0ec15b4d4869...
• VirustTotal Verdict: Generic.ml (3/69)

[eluis]

Hi Gdomenech,

you can add your legit software signer as a trusted signer. Second choice will be to add that hash to the allow list. 

Kr,
Luis

[gdomenech]

Hi Luis,

We are not clients of Palo Alto but some of our clients are clients of yours and have the false positive detection problem. Is there a way you can fix it globally?

Thanks!

Gonzalo

[bbarmanroy]

Hi @gdomenech the ideal process is to get your clients to raise a support ticket at https://support.paloaltonetworks.com/ with the details of the alert (tenant ID, alert ID, incident ID, signer, hash etc.). That'll make sure that the problem is documented and resolved though the standard channels for a global fix. 

As tactical fixes, as @eluis has mentioned, your customer can allow the hash. Allowing the hash is a one-time process, and your clients might run into the same problem when a new version of the software is released. Similarly, allowing the signer is a broad-based control and I wouldn't recommend that either as a systemic fix.

[gdomenech]

Thanks, We will ask our customers to raise a support ticket.