Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
06-20-2019 06:50 AM
Hello,
We are getting several false positives for the following:
Hashes: MD5 -
522aaef14fd04b0cfbb92a5fb67f8daa
c5d262166b7f4e9972d7e3e25df36d5c
1910b1d2c94992fc21c6431a0eae1d78
1ea5f8f65c07140d6fe639cf792a210c
ffabe0604710b1070d044aa137465cd1
48b696a3e96865a38cb4ee6c34163f19
8d6abf4c351ee1d30ba40ddd61a2d60f
b636ebe64a2905f61d659a854c5d5cf4
e4de7fb09f13c7d0cb4d31083a1b6706
ef002bca6c0f92debfa2d896a727ceaa
08-21-2019 09:35 AM
UPDATE:
Turns out there was a GPO to not permit logins to multiple sessions. This GPO called on a directory and copied some files locally. It wasn't until we started looking at the AV in addition to Palo we saw there was a "login.exe" being detected and flagged. After moving the user's OU and deleting the local copy, the GPO no logger applied and the alerts ceased.
Luckily there was a "misc:" field in the Palo alert which eventually tipped us off.
Best of luck!
08-20-2019 08:43 PM
I'm getting a similar false positive for Microsoft Directory Services/ms-ds-smbv3 - Virus/Win32.WGeneric.adwxyf. Occurs when attempting to copy Symantec Antivirus from a share.
08-21-2019 09:35 AM
UPDATE:
Turns out there was a GPO to not permit logins to multiple sessions. This GPO called on a directory and copied some files locally. It wasn't until we started looking at the AV in addition to Palo we saw there was a "login.exe" being detected and flagged. After moving the user's OU and deleting the local copy, the GPO no logger applied and the alerts ceased.
Luckily there was a "misc:" field in the Palo alert which eventually tipped us off.
Best of luck!
09-04-2019 08:54 AM
In the future open a case with Palo Alto networks through your portal. THis is not the place to discuss your private network.
As a Palo Alto customer you have Support included and we could find and fix this much faster without exposing your files to the internet.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
