Threat-Emulation false-positives after detection rule update

[APT_Protection]

Hello,

maybe someone else experience the same at the moment. I can see a lot of potential false-positive detections via Threat-Emulation today.

They all have in common, that these detections are from Win10 vm environment, which was the only one that got an detection rule update today. I think todays detection rule update introduced a problematic detection.

All false-positives have the same single activity in the report:

Suspicious Process activity C:\Windows\splwow64.exe (Start)

Detection Rules

============================================== Win10 64b,Office 2016,Adobe DC ------------------------------ UID: 10b4a9c6-e414-425c-ae8b-fe4dd7b25244

Revision: 59312 Status: Ready Size: 118.61KB Start Download Time: Tue Nov 22 19:00:57 2022

Revision: 59314 Status: Ready Size: 118.42KB Start Download Time: Mon Dec 5 15:27:25 2022

The other vm detection rules werent updated today and they dont show this Suspicious Process activity...

br

[PhoneBoy]

False positives do happen from time to time and should be reported to the TAC.

[APT_Protection]

Its not only a normal false-positive...

Almost every emulation via win10 vm was detected as malicious because of this new detection rule. I had to disable the win10 vm as a workaround.

[asafav]

Hi,

A single Detection-rules signature was causing a high FP rate.

New Detection-rules package has been just released fixing the issue.

You can force update your Detection-rules package using "tecli advanced download update rules".

Sorry for the inconvenience.

Asaf,

Threat Emulation R&D 

[APT_Protection]

Hi Asaf,

alright, thanks for the information!

The update worked so far in my lab. my testfiles(fp's)are now handled "normally"...

I will role this out in our production step by step and monitor the situation.

br

Ronny