False positive?

[ALTF4]

Heyo everyone,

Had a tonne of machines alerting for SHA256: 07cd10ab304ae0017dd903b91e2d68952508e5120073a27d6ae1affe5b0af198

I'm pretty sure this is a false positive but I've had a look and cant find any information anywhere yet cause I think its quite recent, just wanted to check in and see if anyone else has experienced the same?

Cheers!

[YZ2]

We are facing the same challenge of identifying whether this is a false positive or whether it really is something that needs to be looked at more closely.

C:\Users\****\AppData\Roaming\Zoom\6.4.6.64360\Zoom.msi is moved to quarantine.

detected Zoom.msi as W32.07CD10AB30-95.SBX.TG

[Bunged]

We observe the same behaviour in our environment, too.

[David Janulik · Accepted solution]

We are aware of the issue. The file disposition in Cisco Secure Endpoint, was changed. You should see the effectivity already.