Microsoft Hafnium Test Picks Up Veeam Agent As False Positive

[AlexLeadingEdge]

Hi guys,

Running Microsoft's Hafnium compromise test on our Exchange server picks up Veeam Agent's .zip files in ProgramData as 'SuspiciousArchive', which apparently is a sign of Hafnium compromise (zip, rar and 7z files under ProgramData):

https://github.com/microsoft/CSS-Exchan ... /README.md

I realise this is Microsoft's issue, but I just thought I would mention it.

[Regnor]

This isn't a false positive per definition. As you say the script looks for any archives in the programdata folder, because it could be a sign of data export. On the other hand there are many other products which create archives there; so you wouldn't be able to filter out good and bad archives via script. This is always a manual task.

[Dima P.]

Hello Alex,

For the most AV vendors we usually submit our files as soon a we receive false positive detection but, as Max stated, there is nothing we can do about rules that aim file extensions. Cheers!