False positive for Edge?

[smaddox]

Hi. I wanted to toss this out there to see if anyone else encountered this in the last week or so.

This morning, I opened up the console to 40% of my endpoints indicating a compromise. I opened one computer to start investigating. I found it to be a respective detection and quarantine attempt of Edge activity. On the surface it looks like a false positive but having over 400 machines in the list, I don't want to be too dismissive. There is a screenshot of the activity details. the sha is
98dbc146a89e65094bda4c1b0a3b2d8c4a5a1b6f93891e97336aba2a1994bcd8 

[Matthew Franks]

I haven't seen anything for this hash. Is it possible someone accidentally added it to a SCD list? Edge is also signed by Microsoft which should prevent it from being quarantined.

Thanks,

-Matt

[smaddox]

It isn't listed as being in the CSD. No file blacklist either. Amp is reaching back to 4/29 for the retrospective detection. I may need to open a TAC case for this one.

[Matthew Franks]

I agree. They should be able to look into the account history and see further details.

-Matt