HEUR:Exploit.Multi.DrvDoc.gen

[Ashley_Black]

We have had a number of calls today for checkpoint detecting 

"C:\ProgramData\CheckPoint\Endpoint Security\TPCommon\Updater\ATPS\Working\652743B2ED95EABB5DE5D88CDC51BF9E396216CD\cuckoo\protections\general\UID612340.pyc" as HEUR:Exploit.Multi.DrvDoc.gen

Currently working under the assumption of a false positive, but trying to verify with checkpoint support.

Anyone else getting this today? 

[Ashley_Black]

Looks like open a TAC case is the way to go according to https://community.checkpoint.com/t5/Endpoint/Checkpoint-blocked-its-own-updater-UID612340-pyc-as-Tro...

[Hamad_Altaf]

Observed this and verified with TAC as false positive. As per TAC, signature should be updated in next couple of hours.