About ShaneMcG

Hi,   In short - I'm looking to a way to identify false positives.   My organisation's anti virus profiles within our Palo NGFWs are detecting multiple generic threats of a 'medium' level and blocking them. I'm trying to determine whether any of these are false positives, and if they should remain blocked.   The threat names all follow the same format: Virus/Win32.WGeneric.######, with the last 6 digits varying for each threat. When I check the threat vault, there is no further information provided as to the nature of the threat, other than a list of hashes associated with it.   I've entered these hashes into VirusTotal.com and also AlienVault to see if any record of these as a malicious activity exists, but I've been unable to find any matches for the 30 or so hashes I've checked so far.   Does anyone know what these hashes actually are? Are they the hash of the file being transferred, or the type of threat itself? We've gone to the source device where the threat was generated and there is no record of the hash that the threat corresponds to in Palo's Threat Vault.   ... View more