topic False Positive? "Adobe Genuine Helper.exe" in Endpoint Security

False Positive? "Adobe Genuine Helper.exe"

MidwestCyber — Thu, 22 Aug 2024 11:40:18 GMT

Anyone else seeing large numbers of failed retrospectives on the following? We have 350 so far.

Disposition: Malicious
Filename: Adobe Genuine Helper.exe
Detection SHA-256: abcf2c8bab98cedb1bd973a0cefa747e6fe9d835248e4471f7cf9c26446abe6e

Appears to be genuine, no other IOCs noted in the environment.

https://www.virustotal.com/gui/file/abcf2c8bab98cedb1bd973a0cefa747e6fe9d835248e4471f7cf9c26446abe6e/detection

Re: False Positive? "Adobe Genuine Helper.exe"

Matthew Franks — Thu, 22 Aug 2024 12:22:47 GMT

I opened a ticket with TALOS to investigate as a False Positive. Next time you have an issue like this, please open a TAC case so we can track it properly.

Thanks,

-Matt

Re: False Positive? "Adobe Genuine Helper.exe"

MidwestCyber — Thu, 22 Aug 2024 12:35:07 GMT

Thanks Matt, was planning on doing so when I arrived at the office this morning.

Re: False Positive? "Adobe Genuine Helper.exe"

Matthew Franks — Thu, 22 Aug 2024 13:49:34 GMT

Looks like TALOS removed the malicious disposition from that file. Thanks for reporting it!

-Matt

Re: False Positive? "Adobe Genuine Helper.exe"

MidwestCyber — Thu, 22 Aug 2024 13:55:28 GMT

Looks like that is reflecting in our portal. Thanks again!