Multiple Secure Endpoint Alerts

[johnmac]

Hi, in the last few hours our Secure Endpoint has alerted to hundreds of events associated with "Gen:Variant.Jatommy.3.3433". While the files are being quarantined in most cases, i believe this may be a false positive, is anyone else seeing these alerts?

thanks,

[Ken Stieers]

I haven't yet... what sorts of files is it hitting on?  

[johnmac]

C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b2fa8ab4e829625f.customDestinations-ms

[mpdonovan]

I am seeing the same thing on a smaller scale. I have only gotten a handful of alerts today. At least at this point.

[Alisabeth N]

I am seeing this happen today as well. All appear to be coming from the parent file msedge.exe. I am seeing two different hashes for this msedge.exe which both are coming up clean.

1d7e81e6a33c0dc5541770b414fb7bc9760141ec9b869dcd9466017292f99d1a

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LUHCRNBMS942Y9B7W95W.temp

C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Y0FE6QYMR6IZ67O9NC0E.temp

C:\Users\xxx\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\T6IWKQUHJLDEE9YHH41B.temp

[Matthew Franks]

TALOS is investigating. 

[johnmac]

Hi Matthew, has there been any update from Talos on this?

[Matthew Franks · Accepted solution]

Good morning. Yes, it was determined to be a False Positive. Apologies for the delay on the update, the resolution came after I was out for the day. 

-Matt

[johnmac]

Great, thanks for that Matthew. 

[tbduff001]

Does anyone know if this has officially been determined to be a False Positive?