Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivirus

[KRisselada]

Hello, 
Are seeing the following in Cortex XDR 
'Threat ID #348815361' generated by PAN NGFW detected on host 10.x.x.x involving user ZZZZ\first.last

Threat ID: 2418537

Current Release: 3394 (2020-06-28 UTC)

First Release: 3394 (2020-06-28 UTC)

SHA256:    1d279269b17d9282b061be59ba23a0fadecae6e44e12ea4054d4637ae736d748

Unfortunately it seems that its not at all uncommon for OneDriveSetup.exe to be flagged by PAN AntiVirus Threats as a generic W32 Virus.  Seen this happen in June, also back in April.  Is there a known reason why PAN A/V Threats continue to "misfire" on this?

@hisingh is this anything you have already heard or been aware of?  I see you were involved in a prior discussion of this False Positive, back in April

History of this in the instance of Cortex XDR that I currently have access to from my customer.  I do not have access to their Panorama or their NGFW configs, thus can not obtain capture at this time.

[bit_byte]

Palo alto has been release new signature Virus/Win32.WGeneric.aktpum.
Name: Virus/Win32.WGeneric.aktpum
Threat ID: 2418537
Unique Threat ID: 348815361

hash of sha-256=1d279269b17d9282b061be59ba23a0fadecae6e44e12ea4054d4637ae736d748

https://threatvault.paloaltonetworks.com/

Unique Threat ID: 348815361
We are getting Virus alerts in the Threat log for OneDriveSetup.exe .
is that false positive ?
how should I stop this threat alert ?

@KRisselada 

@hisingh 

@HULK 

[KRisselada]

Hello @bit_byte if you have access to Panorama, PAN Support indicates the following can be done.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm3aCAC

In this case, I don't have access to this in the particular customer that had this occur.  This was seen in Cortex XDR Incidents which Cortex is the only access we have to this customer.  Hoping that PAN Threats team simply deactivates the AV Signature as soon as possible so that next daily A/V Threat update, it will be applied.  In the mean time, if you have Panorama configuration access, you should be able to put in a Virus Threat exception. It seems this file triggered Virus alerts back in April also.

[bit_byte]

@KRisselada 

We do not a panorama. We have a standalone firewall.

[hisingh · Accepted solution]

Hello @bit_byte  and @KRisselada 

We have identified this signature and it has been disabled in WildFire, it will take about 24-48 hours till this update role into the Anti_virus package. At this time it is safe to add an exception for next 48 hours, here is link how to add exception:https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcrCAC

Best

Himani

[KRisselada]

Thanks for the quick reply @hisingh 
Is there any review of the underlying process that seems to allow what appears to be a rather common file to be flagged like this in the last few months?  Is there any known updates to reduce these sort of false positives?  Its likely not a question you can answer, but I did want to ensure its out there to be seen and commented on perhaps in the future

[hisingh]

We are watching all and taking inputs from our customers.

Thank you for sharing this with us.

Best

Himani

[mivaldi]

The best way to prevent these FP's is to request the software vendor to digitally sign their binaries.

The associated sample was not signed by Microsoft.