We are seeing lot of Teams.nuspec as virus - are they False Positive?

[msb_itservices]

Hi there, 

Lately we have seen number of blocked connection for Teams.nuspec. Virus Total report for Destination IP is shows clean. 

[jcharette]

We've seen a bunch of these as well from when we first started using Microsoft Teams.

Since then, we have bursts of them.  Yesterday was a bad day.  I think they are false positives as well, but I'd love to better understand why we are getting them.

[mivaldi]

Please open a Support case so it can be looked at in detail.

[jmontoya224]

I have also been seeing this file across some of our customers that we monitor. We will get Virus alerts for that file that WildFire is flagging. I don't think this is a virus and is more than likely a false+. I was looking into this a little further and found out that the file is being hosted here https://chocolatey.org/packages/microsoft-teams#files. The file passes all checks on their site which you can view the Registry Snapshot by going to the following link https://gist.github.com/choco-bot/94b957a0ae5da9a075eb88dd4c890bd9. If I get some time I will download the file on my VM and run it through some checks and will update. I agree with the above comment and open a case so that Palo can take a look into this further. Have a good day! 

[mivaldi]

We are looking at it further to understand what is causing the continued FP detections.

All the signatures listed in the screenshot are now disabled.