Base64JS.min.js

[noahigros]

Good afternoon, 

we are using Cisco AMP with our connector version being 8.2.1.21612 and are receiving numerous alerts for a filename Base64JS.min.js. Is anybody else experiencing this? Previously we had a widespread issue with a smss.exe parent process that was found to be an issue with a new BP update on Cisco's end for the same connector version we are on now. Could this be related? 

[Ken Stieers]

Yep... started for me about 20 min ago.
I've opened a Talos file reputation case, but they closed it because the sha already existed in a ticket. (e.g. someone else already submitted it)

[chad.preslar]

Did they update you as to the status? it's been a few hours now since this started. 

[chrisguerrero]

I have 28 isolation events centered around this Base64JS.min.js detection. Can we get word if this is a false positive as we are running scans at the moment this stinks like a false positive.

[noahigros]

thank you both for the input. @Ken Stieers , if you find any further information, please let me know.

[Bbailey2]

I am currently seeing the same issue in my console. 

[Bbailey2]

I'm seeing retrospective detection and retrospective quarantine attempt failed for d2e82495607abf54f16e21de04d90ba9ce1605451667d88425babece988f148b

C:\adobeTemp\ETRDE65.tmp\2\x64\js\node_modules\base64-js\base64js.min.js

[Ken Stieers]

Yep. That's the one I am seeing too.

[_hAcKeR_kIllEr_]

I'm seeing retrospective detection and retrospective quarantine attempt failed on 100+ machines for d2e82495607abf54f16e21de04d90ba9ce1605451667d88425babece988f148b

/c:/adobetemp/etr37a4.tmp/2/x64/js/node_modules/base64-js/base64js.min.js

Two weeks ago we also experienced the sms.exe parent process issue at our organization.

Connector version 8.2.1.21612

[noahigros]

For the retrospective quarantine attempt failure, that's a confusing feature. SEP will quarantine the initial event, but until the event is marked as resolved, it will continuously monitor it as still being present and search for the signature that no longer exists due to it already being handled. Thus resulting in a quarantine failure. You could always verify by going into the device trajectory and look for persistence on the same host, but in my experience it's never the case and very time consuming considering the number of alerts. 

[The Security Guy]

We're seeing this as well. Did you get any additional info from Cisco or Talos?

[xdumont]

Hello, same problem here with base64js.min.js. Any news on your side?

[ventaran]

The execution parent in my environment is setup.exe from Adobe. The Adobe setup.exe file is clean. This is most likely a false-positive. Lighting up my environment with this.

[xdumont]

On our side it's the latest release of XMind for Windows https://xmind.app/download/

[ventaran · Accepted solution]

Hello Anthony,

Thank you for contacting us, I am Sara from ATS TAC, and I will be working with you on that case. From what I understand you would like to report a False Positive detection for base64js.min.js (d2e82495607abf54f16e21de04d90ba9ce1605451667d88425babece988f148b), correct me if wrong.

Please note that we are aware of this False Positive detection and this was already taken care of.

Talos has analyzed the file and deemed it benign. We have rectified the issue by changing the file disposition in Cisco Secure Endpoint, which effectively allows the customer to access the file. This update should be reflected on the customer’s appliance in the next 1-2 hours. The source of the conviction has been notified so that they can use this example to improve detection content, which will help prevent future false positives. Thank you for bringing this to our attention and let us know if you need further assistance.

Should you receive any recent detections, please proceed with updating your Connectors on the affected Endpoints. We apologize for any inconvenience this can cause.

Regards,