About MartinPfeil

Same problem, based on the replies here I regard it as a false positive ... View more

Is there any possibility to either fine-tune or completely disable this and similar signatures? This signature and " sync.vulnerable_driver_loaded_WinRing0.sys" prevented a update of different HP signed drivers on several systems. ... View more

I noticed the same issue, the Virustotal link is gone from the "Key Assets and Artifacts" view. It is still available in the QuickLauncher menu which is another extra step to investigate a suspicious file.  ... View more

I haven't seen anything from Palo Alto yet. We are using the following XQL query to detect attacks, obviously it is a little bit rough and any improvement is welcome   dataset = xdr_data | filter action_process_image_name contains "msdt.exe" | filter action_process_image_command_line contains "PCWDiagnostic" and action_process_image_command_line contains "IT_RebrowseForFile" | fields _time, agent_hostname as host, actor_effective_username as user, actor_process_image_path as parent_process, action_process_image_path as executed , action_process_image_command_line as command_line ... View more

Hello Eluis, this is a standard procedure when we identify false positive alerts: report an incorrect verdict back to Palo Alto. Unfortunatly we still have to deal with the results of the initial false positive detection, e.g. messed up and incomplete software installations and updates because WF blocked access to certain files on several systems. This happens especially with software development tools and foreign language software, especially Chinese.  ... View more

We have similar problems with white-listed binaries and received the following explanation: The white listing only adds the hash to a list of static IOC, if the binary acts in a suspicious way (either live or in WildFire) it will be blocked. One solution is to always run the latest version and report false positives, the other one is creating a malware profile which excludes certain files and folders from being scanned.   ... View more

Unfortunatly Wildfire produces a lot of false positives, we have to unblock and whitelist Cygwin binaries in regular intervals. Of course,  I report the incorrect verdict to PA and it is reversed in a short time. But that doesn't help with binaries blocked initally using an incorrect verdict. Apart from adding known hashes to the whitelist, the only workable solution I found out is to exclude known folders from being scanned. Of course, this is not very secure and has it's own issue but it allows our developers to continue with their business ... View more

It is benign software, initally identified as malware. Same thing happend in the last two days for other software updates, like for Epson and HP: Initially identified as malicious but then the verdict was reversed a few hours later. Files had to be released manually and hashes had to be added by hand to the whitelist ... View more

It is benign software, initally identified as malware. Same thing happend in the last two days for other software updates, like for Epson and HP: Initially identified as malicious but then the verdict was reversed a few hours later. Files had to be released manually and hashes had to be added by hand to the whitelist ... View more