False Positives on WSL .exes ?

[HenkPoley]

These files:

• almalinux8.exe ('AlmaLinux 8 WSL' from Windows Store)
  • https://www.virustotal.com/gui/file/ab7eb825d3abeb15b69bd1c4b1ba79d731d68ac365ff4c9fefbab444e8b48772/detection
  • https://analyze.intezer.com/analyses/a2081f93-778e-48dc-8b3b-c76e377bdcc5
• wsl.exe (ought to be by Microsoft)
  • https://www.virustotal.com/gui/file/96b68b3ad3902957024fe9be3bc3ea51475ea3a73c9936b769cbab07304c0aec/detection
  • https://analyze.intezer.com/analyses/ccbf629c-13e2-4306-a39c-1f391b4550a5
• wslhost.exe (ought to be by Microsoft)
  • https://www.virustotal.com/gui/file/bd13d44efb90c2bb508cc661858d3631f3964810b0aa1121638a41f33f8bf719/detection
  • https://analyze.intezer.com/analyses/fbc401bb-952f-4bb5-b19b-349869756903/sub/f961962c-00c3-40e3-ac01-18cae0c1872b/genetic-summary

Shows hits on rules:

• Bazar Drops the Anchor
  • cobalt_strike_tmp01925d3f
  • anchor_x64
  • anchorDNS_x64
• Cobalt Strike
  • cobalt_strike_tmp01925d3f

[HenkPoley]

More false positives:

• IntelCpHDCPSvc.exe
  • https://www.virustotal.com/gui/file/8b3452399a6534db8093ddac726cbf3864e7220caaa4f8928882d5375272e389/detection
  • https://analyze.intezer.com/analyses/4e8c1ddb-6c8d-4844-b8fa-c6186fbdc1d9
• IGFXCUISERVICE.EXE
  • https://www.virustotal.com/gui/file/f2f30e536f4f6ef44c5c768afc289ecfcfcc22ea2e7a80182ab74ea1d4c9604f/detection
  • https://analyze.intezer.com/analyses/f3684f34-5f89-4fec-bcbc-e04bc2467af5

[lunixbochs]

I'm running into a bunch of false positives from cobalt_strike_tmp01925d3f as well, at a quick glance it seems to match every single codesigned exe under 1MB that chains to the Sectigo root.

Based on that I'm considering everything in these search results as a likely false positive rule: https://github.com/The-DFIR-Report/Yara-Rules/search?q=sectigo

[scp-66]

Is cobalt_strike_tmp01925d3f seriously?A lot of false positives.

[baderj]

The rules

• cobalt_strike_tmp01925d3f
• anchor_x64
• anchorDNS_x64

from Bazar Drops the Anchor all trigger many false positives, because they flag all files that have these four very common strings:

1. AppPolicyGetProcessTerminationMethod: This string appears in the universal C runtime (UCRT), in particular the exit function.
2. operator<=>: This is a string literal in the operator mapping table.
3. operator co_await: same as above
4. api-ms-win-appmodel-runtime-l1-1-2 (utf-16): This appears in the filename of the DLL for the AppModel Runtime

All four strings are very common in programs that use the universal C runtime (1-3) and AppModel runtime (4).

We just completed an overhaul of the ruleset along with some FP tuning that should help resolve the reported false positives here.
#5

[HenkPoley]

I don't see any mention of Cobalt or Bazaar anymore on those VirusTotal pages, so at least over there it is resolved as well.

Closing the ticket.