"SecureDriveService.dll"

[jesusyas]

Hello,

While performing a malware analysis on Cortex XDR, Wildfire has detected a file on the computer as possible malware. The file has also been analyzed in other intelligence tools and has not been detected as malicious, the only tool that detects it as malware is Palo Alto Networks. It is the file "SecureDriveService.dll", with description PE32+ executable (DLL) (GUI) x86-64, for MS Windows, with SHA256: e69a1b28a5b71549177f09a9ef7a336831400479ce6f3c6856bc8a818170745d.

Please , could you give us some feedback and indicate if it can be treated as false positive?

BR

[mfakhouri · Accepted solution]

Hi @jesusyas,

To further assess if the verdict reported is a false positive, details of the WildFire analysis can be reviewed. To open the WildFire Analysis Report:

1. Navigate to the relevant incident. Right-click the Incident and select “View Incident”
2. From the “Key Artifacts” list incorporated with the Incident, select the report icon as demonstrated. This will take you to the WildFire Analysis Report.

This report will contain detailed sample information leading up to the case of the WildFire verdict. 

If the verdict is determined to be a false positive, a report can be made at the top right of the WildFire Analysis Report menu. This will report the error to our threat team.

If you are still unable to confirm the validity of the detected file, we highly recommend submitting a support ticket to identify and remediate the issue at support.paloaltonetworks.com. This will ensure that the issue is documented and a fix is implemented if there is a false positive.

Reference:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-respo...