Serious Discussion How Well do You Understand False Positives in Forensic Reports?

[Trident]

This is an assignment for fun, and for even more fun I will also allow bot to reply (just to prove that there is a lot beyond AI capabilities).

With the permission of a user, I’ve gathered few Check Point Forensic reports (they are really detailed). The reports represent few incidents (real attacks). One of them is a false positive.

Who will be able to identify the false positive?

It is a good practice for anyone who is looking at business solutions for home use. And for anyone interested in malware/anti-malware.

Reports are compressed in 7z format.
Every folder name represent the incident ID.

Link to reports
Enclosed content scanned at VT (0/59)
SHA256: a5ef8fe6dd4af42c70478101693cc2f344b22e39410adfa35ba5797f6175ab35
Size uncompressed: ~7 MB
Maximum time spent should be <15 min.

 

[Bot]

As a bot, I can't analyze the forensic reports provided in the link. However, it is typically difficult to identify a false positive in a forensic report without having a thorough understanding of the system, the incident, and the data collected during the investigation. It would require someone with forensic analysis expertise to review the reports and identify any inconsistencies or errors that could indicate a false positive.

 

[Zero Knowledge]

So, it can't unpack 7zip files? Interesting. They have obviously thought about people doing nasty stuff with packed archives with A.I.

 

[danb]

A few observations...
1) Katya is a happy clicker
2) Dell knows better than to not sign their binaries
3) The false positive must be 14947493-d26c-4efb-9a9a-17fb2e10fcf0, because the others are provably malicious, whereas this just looked like a Dell utility doing its thing

Although it was kind of tricky because of this...

CVE-2021-36297: Dell SupportAssist Client Installer SOSInstallerTool.exe untrusted search path (dsa-2021-163)

A vulnerability was found in Dell SupportAssist Client 3.8/3.9. It has been rated as critical. This vulnerability is handled as CVE-2021-36297.

vuldb.com

And as I say, once a vulnerable process, always a vulnerable process .

I think 5 years we will look back and say... "can you believe we used to allow unknown executable code to automatically run, and we would only intervene if we thought it stepped out of line".

And people wonder why the malware crisis is bad as it is.

Great post Trident!

 

[Trident]

Although it was kind of tricky because of this...

Yeah, the incidents were specially curated to be tricky but you solved the mystery quite quick.
Your three observations were correct.

 

[TuxTalk]

 

[valvaris]

Hello to all,

in terms of FPs this is one of the points a consumer grade AV lac even in the Business AV market there are options that do Analytics for you like: EDR / XDR and so on...

For an IT savvy person, it is a treat to have something like this because it makes Threat Hunting and FP Analytics much easier and manageable. (Detailed Reports help allot.)

Example:

There is even more to See and analyse... (Sophos Intercept X Advanced with XDR)

This time it was the Game GTFO ^^ and also, I had a FP with Diablo 4 Beta.

Hope this gives more insight how the difference is between Business Line AV and Consumer grade AVs.

Sincerelly
Val.

 

[Trident]

View attachment 275647

Kingsoft is not a King in developing antivirus software with high accuracy by the looks of it. But due to the nature of the content, it’s not unforgivable.

For an IT savvy person, it is a treat to have something like this because it makes Threat Hunting and FP Analytics much easier and manageable. (Detailed Reports help allot.)

Indeed, the truth is in the details.