Threat False Positives?

[OGMaverick]

Our threat logs are full of 'Fallout Exploit Kit Detection' this morning from many of our networks, although no actul issues have been found.

[bbilut]

Same here...I installed 8077 this morning when I get in after reading the email and I'm getting Fallout alerts like crazy. I don't have as many as you, but people just starting coming in.

[BPry]

@bbilut @OGMaverick,

For the time being I would recommend rolling this back to 8076. The Fallout siganture has actually been around since 8074, but whatever modification PA has done to the signature is a tad to broad at the moment. 

[bbilut]

I'm rolling back to 8076 and I'll report back what happens. I was getting a detection about every minute or multiple per minute with 8077.

Edit: 8076 seems to have stopped the mass amount of alerts.

[OtakarKlier]

Hello,

Looks like this was the emergency update that came out last night:

I usually set my dynamic updates with a threshold that will allow the updates to bake since they have released bum updates in the past. I understand there are some environments where this is not possible.

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/threat-prevention/best-practices-for...

Regards,

[pkowalewski]

I m rolling back to 8076 - and alers from IPS disappear.

[Curt_Wilson]

Yeah, we are also getting a lot of the Threat ID 30650 events.  All events seem to include a *.min.js or *.js file name.

[pkowalewski]

I had the same files - *.js

[bbilut]

I do the same... I'm usually a week behind because their updates have burnt me in the past several times. This one seemed urgent so I manually updated this morning. I guess that was a mistake.

[pkowalewski]

..Palo Alto - not often makes mistakes in signatures... but .... 🙂 it happend...

[OtakarKlier]

Agreed, no one is perfect. I usually have a 24 hour threshold on any new signatures for app/threat.

[M.Eberhardt]

Same here. PaloAlto 5050 with Application and Threat Version 8077-5070.

Many critical threat log entrys with name-of-threatid eq 'Fallout Exploit Kit Detection' as false-positives.

[hshawn]

I looked at the js files being flagged. there must be something in them that is a close match. since these are not critial .js files I am leaving the block in place for now. Has anyone reported this to PA yet?

[mikebowen]

I just opened a case with PA to see what they say. So far it's creating an issue for one website we use, blocking a particular js file from loading and rendering the website inoperable. 

[BPry · Accepted solution]

FYI,

8078 was just released that is suppose to address the issue.