topic Re: FP on Microsoft Edge update? in Endpoint Security

FP on Microsoft Edge update?

Ken Stieers — Thu, 13 Apr 2023 13:29:03 GMT

Hey guys,

Anyone else seeing this:

Detection: W32.082827C4A5.RET.SBX.TG
File: MicrosoftEdge_X64_112.0.1722.39_112.0.1722.34.exe
File path: file:///C%3A/Program%20Files%20%28x86%29/Microsoft/EdgeUpdate/Install/%7BBEA8EA03-94F9-45AB-AC52-0309F5FD1DF3%7D/MicrosoftEdge_X64_112.0.1722.39_112.0.1722.34.exe
Detection SHA-256: 082827c4a5582f887901c4cce83a1aa9b8a4eb23835a434fc104bba745172a85

Feels like an FP to me.

Ken

Re: FP on Microsoft Edge update?

jeremy.peace-hall — Thu, 13 Apr 2023 13:49:19 GMT

We are also seeing a large number of these this morning.

Re: FP on Microsoft Edge update?

pmedinac — Thu, 13 Apr 2023 13:53:47 GMT

Our team is actively looking on this SHA-256 investigation to either discard if it is a FP event or not. Thank you for sharing.

Re: FP on Microsoft Edge update?

ac513 — Thu, 13 Apr 2023 14:40:41 GMT

Just got FP confirmation from a Cisco Secure Endpoint announcement email about 15 minutes ago.

Re: FP on Microsoft Edge update?

pmedinac — Thu, 13 Apr 2023 14:43:08 GMT

Hey,,

This SHA-256 is already marked as clean after analysis:

SHA-256: 082827c4a5582f887901c4cce83a1aa9b8a4eb23835a434fc104bba745172a85

You should see the alerts stop during the next minutes/hours, as soon as the endpoints receive the latest definition updates.

Pedro M.

Re: FP on Microsoft Edge update?

keitha — Thu, 13 Apr 2023 14:49:20 GMT

Hi pmedinac

also seeing alerts on 975c0d48c41d2ad76a242d5f7270f4bf8063bb9c753b375ab2c47c9e2060f562. Same/similar issue?

Re: FP on Microsoft Edge update?

Ken Stieers — Thu, 13 Apr 2023 14:52:27 GMT

Just got that one too...

Re: FP on Microsoft Edge update?

jeremy.peace-hall — Thu, 13 Apr 2023 14:53:28 GMT

Also seeing this SHA-256 detection on our Firepower appliances

Re: FP on Microsoft Edge update?

Ken Stieers — Thu, 13 Apr 2023 15:05:27 GMT

My TAC engineer says Talos just poked that one clean too.

Re: FP on Microsoft Edge update?

pmedinac — Thu, 13 Apr 2023 15:11:11 GMT

Yeap, I double check and that one (975c0d48c41d2ad76a242d5f7270f4bf8063bb9c753b375ab2c47c9e2060f562) was is also Clean.

Same as the other, it may take some time to get the endpoint updates to stop alerts.

Greetings.

Pedro M.

Re: FP on Microsoft Edge update?

mski7861 — Thu, 13 Apr 2023 15:32:40 GMT

Same issue. Do we still need to whitelist the SHA256? Or has Cisco corrected the behavior detection?

Re: FP on Microsoft Edge update?

pmedinac — Thu, 13 Apr 2023 15:35:50 GMT

This is already corrected, the endpoints may take some time to get the latest update.

Pedro M.

Re: FP on Microsoft Edge update?

magragen — Thu, 13 Apr 2023 15:44:57 GMT

Does this have anything to do with the Cisco-Maintained Exclusion list changes that were done yesterday?

Re: FP on Microsoft Edge update?

pmedinac — Thu, 13 Apr 2023 16:03:40 GMT

Nope, this has nothing related to the Cisco-Maintained Exclusion list modified yesterday.

This is just an incorrect conviction that has been fixed at the moment.

Pedro M.