topic Re: fp on svchost.exe on Windows 2019 servers? in Endpoint Security

fp on svchost.exe on Windows 2019 servers?

Ken Stieers — Mon, 04 Apr 2022 19:20:30 GMT

Hey all,

are you seeing an FP on svchost.exe? Mostly Cloud.IOCs...

Ken

Re: fp on svchost.exe on Windows 2019 servers?

Brian.Cochran — Mon, 04 Apr 2022 19:54:35 GMT

We are seeing it on multiple windows machines

Re: fp on svchost.exe on Windows 2019 servers?

jwilliams2 — Mon, 04 Apr 2022 20:01:27 GMT

It has been flagged on all my servers, But no Windows desktop machines.

Re: fp on svchost.exe on Windows 2019 servers?

SReed2020 — Mon, 04 Apr 2022 20:02:25 GMT

Is this a false positive? A whole bunch of machines on our network are being isolated due to this event.

Re: fp on svchost.exe on Windows 2019 servers?

jwilliams2 — Mon, 04 Apr 2022 20:12:21 GMT

Thanks for the update.

Re: fp on svchost.exe on Windows 2019 servers?

philippaisley — Mon, 04 Apr 2022 20:19:29 GMT

Having this on many of our Desktops and Servers.

Re: fp on svchost.exe on Windows 2019 servers?

soup_dragon — Mon, 04 Apr 2022 20:21:08 GMT

Seeing the same, only on 2016/2019 Windows servers.

Have undertaken what checks we can in the time and all coming back no threat.

Still digging.

Re: fp on svchost.exe on Windows 2019 servers?

Rene Mueller — Mon, 04 Apr 2022 20:30:12 GMT

Any update on this problem? We also have 2019 servers jumping into isolation mode regarding svchost fp.

Re: fp on svchost.exe on Windows 2019 servers?

soup_dragon — Mon, 04 Apr 2022 20:39:55 GMT

Cisco advise False Positive

Cisco Secure Endpoint Announcement - False Positive detection
Cisco is aware of the false-positive detection related to svchost.exe. The single SHA-256 involved is cb19fd67b1d02......96cfe0ee0c6e45285436a1. The file disposition has been updated and Cisco is investigating the root cause. We apologize for any inconvenience this may have caused.

Re: fp on svchost.exe on Windows 2019 servers?

Ken Stieers — Mon, 04 Apr 2022 20:42:21 GMT

I put in a file reputation request on TalosIntelligence.com
Tweeted TalosIntelligence.
Opened a TAC case.

Re: fp on svchost.exe on Windows 2019 servers?

Ken Stieers — Mon, 04 Apr 2022 21:09:21 GMT

If you investigate it using Cisco Threat Response it comes up marked as a "Common SHA-256 Hash"
Nobody on Virus Total marks it bad.
Malwares.com marks it good.

Yeah... its an FP...