Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivirus

Reply
Highlighted
L2 Linker

Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivirus

Hello, 
Are seeing the following in Cortex XDR 
'Threat ID #348815361' generated by PAN NGFW detected on host 10.x.x.x involving user ZZZZ\first.last

 

Threat ID: 2418537

Current Release: 3394 (2020-06-28 UTC)

First Release: 3394 (2020-06-28 UTC)

SHA256:    1d279269b17d9282b061be59ba23a0fadecae6e44e12ea4054d4637ae736d748

 

Unfortunately it seems that its not at all uncommon for OneDriveSetup.exe to be flagged by PAN AntiVirus Threats as a generic W32 Virus.  Seen this happen in June, also back in April.  Is there a known reason why PAN A/V Threats continue to "misfire" on this?

 

@hisingh is this anything you have already heard or been aware of?  I see you were involved in a prior discussion of this False Positive, back in April

History of this in the instance of Cortex XDR that I currently have access to from my customer.  I do not have access to their Panorama or their NGFW configs, thus can not obtain capture at this time.

Screen Shot 2020-06-29 at 11.23.17.png

 

 

Accepted Solutions
Highlighted
L4 Transporter

Hello @Sonu_Singh  and @KRisselada 

 

We have identified this signature and it has been disabled in WildFire, it will take about 24-48 hours till this update role into the Anti_virus package. At this time it is safe to add an exception for next 48 hours, here is link how to add exception:https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcrCAC

 

Best

Himani

Himani Singh

View solution in original post


All Replies
Highlighted
L2 Linker

Capture1.PNG

Palo alto has been release new signature Virus/Win32.WGeneric.aktpum.
Name: Virus/Win32.WGeneric.aktpum
Threat ID: 2418537
Unique Threat ID: 348815361

hash of sha-256=1d279269b17d9282b061be59ba23a0fadecae6e44e12ea4054d4637ae736d748

https://threatvault.paloaltonetworks.com/

Unique Threat ID: 348815361
We are getting Virus alerts in the Threat log for OneDriveSetup.exe .
is that false positive ?
how should I stop this threat alert ?

@KRisselada 

@hisingh 

@HULK 

Highlighted
L2 Linker

Hello @Sonu_Singh if you have access to Panorama, PAN Support indicates the following can be done.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm3aCAC

In this case, I don't have access to this in the particular customer that had this occur.  This was seen in Cortex XDR Incidents which Cortex is the only access we have to this customer.  Hoping that PAN Threats team simply deactivates the AV Signature as soon as possible so that next daily A/V Threat update, it will be applied.  In the mean time, if you have Panorama configuration access, you should be able to put in a Virus Threat exception. It seems this file triggered Virus alerts back in April also.

Highlighted
L2 Linker

@KRisselada 

We do not a panorama. We have a standalone firewall.

Highlighted
L4 Transporter

Hello @Sonu_Singh  and @KRisselada 

 

We have identified this signature and it has been disabled in WildFire, it will take about 24-48 hours till this update role into the Anti_virus package. At this time it is safe to add an exception for next 48 hours, here is link how to add exception:https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClcrCAC

 

Best

Himani

Himani Singh

View solution in original post

Highlighted
L2 Linker

Thanks for the quick reply @hisingh 
Is there any review of the underlying process that seems to allow what appears to be a rather common file to be flagged like this in the last few months?  Is there any known updates to reduce these sort of false positives?  Its likely not a question you can answer, but I did want to ensure its out there to be seen and commented on perhaps in the future

Highlighted
L4 Transporter

We are watching all and taking inputs from our customers.

Thank you for sharing this with us.

 

Best

Himani

Himani Singh
Highlighted
L6 Presenter

The best way to prevent these FP's is to request the software vendor to digitally sign their binaries.

The associated sample was not signed by Microsoft.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!