We are seeing lot of Teams.nuspec as virus - are they False Positive?

[msb_itservices]

Hi there, 

Lately we have seen number of blocked connection for Teams.nuspec. Virus Total report for Destination IP is shows clean. 

[jcharette]

We've seen a bunch of these as well from when we first started using Microsoft Teams.

Since then, we have bursts of them.  Yesterday was a bad day.  I think they are false positives as well, but I'd love to better understand why we are getting them.

[mivaldi]

Please open a Support case so it can be looked at in detail.

[jmontoya224]

I have also been seeing this file across some of our customers that we monitor. We will get Virus alerts for that file that WildFire is flagging. I don't think this is a virus and is more than likely a false+. I was looking into this a little further and found out that the file is being hosted here https://chocolatey.org/packages/microsoft-teams#files. The file passes all checks on their site which you can view the Registry Snapshot by going to the following link https://gist.github.com/choco-bot/94b957a0ae5da9a075eb88dd4c890bd9. If I get some time I will download the file on my VM and run it through some checks and will update. I agree with the above comment and open a case so that Palo can take a look into this further. Have a good day! 

[mivaldi]

We are looking at it further to understand what is causing the continued FP detections.

All the signatures listed in the screenshot are now disabled.

[it.tbpl]

still false-positives for threat id: 346399143  filename: Teams.nuspec -  Virus/Win32.WGeneric.akfdwd

Content version: Antivirus-3376-3887

[dparris]

The signature 346399143 was disabled 06/11/2020

[mivaldi]

The signature is removed beginning with Antivirus version 3377-3888

[it.tbpl]

Another: teams.nuspec -  Virus/Win32.WGeneric.a

signature: 346947453 (in Antivirus-3380-3891)

Filename: Teams.nuspec

[jcharette]

Same!  We've received a bunch of those as well.

The virus 346947453(346947453) was detected at Teams.nuspec

[mivaldi · Accepted solution]

346947453 was disabled and is now removed from Antivirus 3381

[LeighCostin]

And it seems to be back again - Threat ID #356771745 Virus Teams.nuspec detected via an Antivirus profile.Excluded it and raising a note with PAN.

[mivaldi]

356771745 was disabled and will be removed from tomorrow's release of the Antivirus signature package.