"SecureDriveService.dll"

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

"SecureDriveService.dll"

L0 Member

Hello,

While performing a malware analysis on Cortex XDR, Wildfire has detected a file on the computer as possible malware. The file has also been analyzed in other intelligence tools and has not been detected as malicious, the only tool that detects it as malware is Palo Alto Networks. It is the file "SecureDriveService.dll", with description PE32+ executable (DLL) (GUI) x86-64, for MS Windows, with SHA256: e69a1b28a5b71549177f09a9ef7a336831400479ce6f3c6856bc8a818170745d.

 

Please , could you give us some feedback and indicate if it can be treated as false positive?


BR

1 accepted solution

Accepted Solutions

L3 Networker

Hi @jesusyas,

 

To further assess if the verdict reported is a false positive, details of the WildFire analysis can be reviewed. To open the WildFire Analysis Report:

 

  1. Navigate to the relevant incident. Right-click the Incident and select “View Incident”
  2. From the “Key Artifacts” list incorporated with the Incident, select the report icon as demonstrated. This will take you to the WildFire Analysis Report.

mfakhouri_1-1664820602324.png

 

This report will contain detailed sample information leading up to the case of the WildFire verdict. 

 

If the verdict is determined to be a false positive, a report can be made at the top right of the WildFire Analysis Report menu. This will report the error to our threat team.

 

 

mfakhouri_3-1664820602337.png

 

If you are still unable to confirm the validity of the detected file, we highly recommend submitting a support ticket to identify and remediate the issue at support.paloaltonetworks.com. This will ensure that the issue is documented and a fix is implemented if there is a false positive.

 

Reference:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-respo...

View solution in original post

1 REPLY 1

L3 Networker

Hi @jesusyas,

 

To further assess if the verdict reported is a false positive, details of the WildFire analysis can be reviewed. To open the WildFire Analysis Report:

 

  1. Navigate to the relevant incident. Right-click the Incident and select “View Incident”
  2. From the “Key Artifacts” list incorporated with the Incident, select the report icon as demonstrated. This will take you to the WildFire Analysis Report.

mfakhouri_1-1664820602324.png

 

This report will contain detailed sample information leading up to the case of the WildFire verdict. 

 

If the verdict is determined to be a false positive, a report can be made at the top right of the WildFire Analysis Report menu. This will report the error to our threat team.

 

 

mfakhouri_3-1664820602337.png

 

If you are still unable to confirm the validity of the detected file, we highly recommend submitting a support ticket to identify and remediate the issue at support.paloaltonetworks.com. This will ensure that the issue is documented and a fix is implemented if there is a false positive.

 

Reference:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-respo...

  • 1 accepted solution
  • 1213 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!