wildfire-virus threatID 602574714 false positive ?

[janekpalo]

Good Morning,

Has anyone had WildFire-Virus threat events with the following  threat ID:602574714 ?

Antivirus Signatures 

Showing 1 to 1 of 1 rows

Signature	Release	Hashessha256
Name: Virus/Win32.WGeneric.ebefcf Unique Threat ID: 602574714 Create Time: 2023-08-31 10:08:10 (UTC)	Threat ID: n/a Current Release: n/a First Release: n/a	21219d0038484fdd61b220f7d30b774b6216426f80fc8b2855032c5984410b65

WildFire Signatures 

Showing 1 to 1 of 1 rows

Signature	ReleasePost-7.1	Hashessha256
Name: Virus/Win32.WGeneric.ebefcf Unique Threat ID: 602574714 Create Time: 2023-08-31 10:08:10 (UTC)	Threat ID: n/a Current Release: n/a First Release: 799306 (2023-08-31 UTC)	21219d0038484fdd61b220f7d30b774b6216426f80fc8b2855032c5984410b65

Since a few days we see a large number of alerts about threats detected by wildfire-virus related to traffic detected as ms-update application or web-browsing default action reset-both . Downloaded files are java script files : syntax taskpane_xxxxxxxxxxxxxxx.js, badz index_xxxxxxxxxxxxxxxxxxxxxxx.js.
The public IP addresses they connect to are mainly akamaitechnoligies.com or others, but after checking them on Virus Total or Cisco Talos they do not show any threats.
Has anyone observed similar events on the Palo Alto Firewall ?

Best Regards

[ymiyashita]

It was a False Positive. The signature (TID: 602574714) was already disabled.

[NorcoIT]

It is still live in the threat vault and our firewall is preventing updates. We don't want to add any sort of exception until we get an official response from Palo Alto that this isn't another solarwinds style situation.

[NorcoIT]

looks like in our version of panorama there is a bug that keeps old detections in the cache. we have resolved this

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-release-notes/pan-os-10-2-3-known-and-addressed...