PA firewall treated NBSS Continuation Message as Worm/Win32.vobfus

[MarcusLeung]

Hi all,

Recently the PA firewall received massive threat alert with family Worm/Win32.vobfus.

(Application: ms-ds-smbv3, Port: 445, thr_category: pe)

I have submitted the file samples and the files are clean, we also scan the server and there is no virus.

Which we confirm this alert is a false positive.

Then I take a Threat Packet Capture, PA firewall captures the NBSS Continuation Message.

I see the TCP payload is all zero, it that the reason PA treated the NBSS Continuation Message as Worm/Win32.vobfus?

Please help, thank you!

Regards,

Marcus

[nikoolayy1]

Well just make a new security rule that matches the source and destination with a new antivirus profilewhere the antivirus signature is dissabled and place is before the current rule that is triggering the false positive.

Worm/Win32.vobfus:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PPQgCAO&lang=en_US%E2%80%A...

Exceptions:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcrCAC

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/threat-prevention/create-threat-exceptions