What's your approach with potential FPs?

[blackice]

I'm curious what other people's approach is when they hit on potential FPs on something like Virustotal or Hybrid_Analysis? When you check a file from a trusted source such as Steve Gibson's site for DNS Bench and get something like the following screenshot, what do you do? I know a lot of people just say FP all day, but I've always been more prudent. It seems there is usefulness to VT and H_A, but these ML and heuristic detection engines do seem to flag even base Microsoft .exes a lot (looking at you onedrive and processexplorer). In this situation none of the big vendors flagged the file, or the ones that did cleared it over time, but it does always leave a seed of doubt when there's more than one or two FPs. How paranoid are you?

 

[Protomartyr]

Whenever I find a file that has some detections on VirtusTotal or Hybrid Analysis, I will only run it if:

• It comes from a trusted source. I check the properties of the file to see the digital signatures / author.
• There is an MD5/SHA1/SHA-256 hash available to verify the download.

 

[TairikuOkami]

Small software devs can not afford certificates, so I decide based on reviews. Of course, the detection has to be generic (like a packer), not specific.

 

[blackice]

Small software devs can not afford certificates, so I decide based on reviews. Of course, the detection has to be generic (like a packer), not specific.

In the above case it’s all a generic detection based on the high amount of network/dns traffic.

 

[silversurfer]

I prefer to upload suspicious files or even possible FP to AnyRun and Hybrid-Analysis, after that you may know more about it's really malicious...

 

[DeepWeb]

I avoid anything that isn't signed and like you guys, I throw it at VirusTotal to see what it spits out.

 

[blackice]

I avoid anything that isn't signed and like you guys, I throw it at VirusTotal to see what it spits out.

Interestingly in this case he has an EV certificate. It's definitely a trusted source, Hybrid_Analysis has no love for it though: rated 100% malicious, probably could ask for it to be whitelisted. But how many people really even check these things. Maybe not worth the developer's time? I tend to read what the analysis sites spit out to see what's being labeled as malicious.

 

[upnorth]

If curious enough, I recommend simply submit the file directly to a few major vendors. That normally helps get a better answer.

 

[plat]

Well, this is interesting, this is from the same source as the InSpectre utility for Meltdown/Spectre mitigations. I have InSpectre, so for a lark, here is result:

Spoiler

So, like it was stated, small software run higher risks for "detections" like that. It then is a judgement call. DNS Benchmark has one detection via Jotti from Fortinet--named Win32 ZBot. So, maybe it wouldn't be a bad idea to make an inquiry to Fortinet. By the way, if you have InSpectre and recently applied the enablement KB for 1909, maybe you can run it. I did, both Meltdown and Spectre mitigations were disabled. :emoji_grimacing: Thanks, blackice!

 

[blackice]

Well, this is interesting, this is from the same source as the InSpectre utility for Meltdown/Spectre mitigations. I have InSpectre, so for a lark, here is result:

Spoiler

View attachment 227644

So, like it was stated, small software run higher risks for "detections" like that. It then is a judgement call. DNS Benchmark has one detection via Jotti from Fortinet--named Win32 ZBot. So, maybe it wouldn't be a bad idea to make an inquiry to Fortinet. By the way, if you have InSpectre and recently applied the enablement KB for 1909, maybe you can run it. I did, both Meltdown and Spectre mitigations were disabled. :emoji_grimacing: Thanks, blackice!

That’s the same tag it gave to DNS bench. I’m pretty sure his tools just throw some flags. Inspectre got one hit on VT when I got curious about the same thing. If they were malicious there’d be a lot of infected people since that tool was pretty widely promoted.

 

[show-Zi]

Minor online software distributed by individuals often does not have a certificate, so it is reliably detected
. When I install software like this, I'm going to check the reputation of the people who use it.
You can trust the Michelin-recommended restaurant information, but the small restaurant information you heard at the street corner is also useful.

 

[roger_m]

I pay attention to what vendors are detecting a file as malicious. There are a few vendors which have major issues with false positives and if a file is only detected by these vendors, I consider it to a definite FP.

 

[ForgottenSeer 823865]

Compare the hash. That is it. AVs are encline to block legit things while allowing malicious ones... Main reason I use Default-Deny, everything is considered malicious unless allowed by myself.

 

[Venustus]

Process Hacker is a classic FP:
VirusTotal

 

[roger_m]

Process Hacker is a classic FP:
VirusTotal

Mostly it is detected as being Process Hacker and classified as a PUP or hacking tool. In these cases, it's not a false positive. However I would say that for the average user, they will often assume that anything that is detected by AV software is malicious.

 

[Venustus]

Mostly it is detected as being Process Hacker and classified as a PUP or hacking tool. In these cases, it's not a false positive. However I would say that for the average user, they will often assume that anything that is detected by AV software is malicious.

Agreed on both points!

 

[Mahesh Sudula]

In general avoid detections from grey vendors like Zillya, Maxsecure, CMC, Zoner and few more.QH also has major issue with Fp's.
They are less known and follow detections based on another Vendor.

 

[bribon77]

I pay attention to what vendors are detecting a file as malicious. There are a few vendors which have major issues with false positives and if a file is only detected by these vendors, I consider it to a definite FP.

+1. I use VT and focus on AVs that have a good reputation and are reliable.