topic Multiple Secure Endpoint Alerts in Endpoint Security

Multiple Secure Endpoint Alerts

johnmac — Wed, 03 Apr 2024 14:51:56 GMT

Hi, in the last few hours our Secure Endpoint has alerted to hundreds of events associated with "Gen:Variant.Jatommy.3.3433". While the files are being quarantined in most cases, i believe this may be a false positive, is anyone else seeing these alerts?

thanks,

Re: Multiple Secure Endpoint Alerts

Ken Stieers — Wed, 03 Apr 2024 15:04:17 GMT

I haven't yet... what sorts of files is it hitting on?

Re: Multiple Secure Endpoint Alerts

johnmac — Wed, 03 Apr 2024 15:09:04 GMT

C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b2fa8ab4e829625f.customDestinations-ms

Re: Multiple Secure Endpoint Alerts

mpdonovan — Wed, 03 Apr 2024 16:04:32 GMT

I am seeing the same thing on a smaller scale. I have only gotten a handful of alerts today. At least at this point.

Re: Multiple Secure Endpoint Alerts

Alisabeth N — Wed, 03 Apr 2024 16:11:19 GMT

I am seeing this happen today as well. All appear to be coming from the parent file msedge.exe. I am seeing two different hashes for this msedge.exe which both are coming up clean.

1d7e81e6a33c0dc5541770b414fb7bc9760141ec9b869dcd9466017292f99d1a

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LUHCRNBMS942Y9B7W95W.temp

C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y0FE6QYMR6IZ67O9NC0E.temp

C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T6IWKQUHJLDEE9YHH41B.temp

Re: Multiple Secure Endpoint Alerts

Matthew Franks — Wed, 03 Apr 2024 16:40:07 GMT

TALOS is investigating.

Re: Multiple Secure Endpoint Alerts

tbduff001 — Wed, 03 Apr 2024 20:04:17 GMT

Does anyone know if this has officially been determined to be a False Positive?

Re: Multiple Secure Endpoint Alerts

johnmac — Thu, 04 Apr 2024 08:41:38 GMT

Hi Matthew, has there been any update from Talos on this?

Re: Multiple Secure Endpoint Alerts

Matthew Franks — Thu, 04 Apr 2024 11:33:46 GMT

Good morning. Yes, it was determined to be a False Positive. Apologies for the delay on the update, the resolution came after I was out for the day.

-Matt

Re: Multiple Secure Endpoint Alerts

johnmac — Thu, 04 Apr 2024 11:39:09 GMT

Great, thanks for that Matthew.