Invalid threat ID number, next steps

[tstores]

In the threat logs, the PAN is detecting a virus for internal traffic, server to client, but the threat id doesn't match anything in the threat vault, 1 number too short, 253879. What's the best way to identify if the threat is legitimate, not a false positive? application = ms-ds-smb, url LogoinScript.VBS

[HULK]

Hi,

If you  share your login scripts with us, we will be able to verify the false positive/negative test for it. Also wanted to know, is the file passing through the PANFW while you are logging into the machine..?

Thanks