FSA/RISK_HIGH on Microsoft and Intel binaries.

[Wi3tse]

The last few weeks we are seeing Microsoft or Intel Signed files classed as FSA/RISK_HIGH in both the FortiClient as the Fortigates. 

Our FortiClients are configured to explicitely NOT upload files signed by trusted sources (Like Microsoft, Intel, etc.) to the sandbox service.

Examples: Intel Signed 

WirelessSetup.exe

0E471D466AE6A65B409195EF4619408429C73FF36851E2FA4606DBFB734CAA5A

WirelessSetup.exe

0E471D466AE6A65B409195EF4619408429C73FF36851E2FA4606DBFB734CAA5A

Examples: Microsoft Signed
windowsdesktop-runtime-6.0.25-win-x64.exe

C7B9C0DEA9D686486921AEA9DFB4F86C63D4B11D739FC26BEDB55BE0D96CF0FB

vcredist_x86.exe

9054E5DF6F38CE936F14A98D818FC7896D271EE525D9B2B2E886F137A8AD36C0

vcredist_x64.exe

9FDEAEDE40DDA783413B65882F46CA94A62477C07143A74BB6B43E01A9002D21

My question: Are there other customers which noticed the same issues, and if so, how do you manage this issue in your environment?

We already allowlisted, and restored the false positives above in EMS.

The FSA/RISK_HiGH classification of the files mentioned above also cause blocking during download by the FortiGates, which I believe is not a desirable thing, potentially leaving Windows installations unpatched, or even in a corrupted state.

Kind regards,

Wietse van Assema

[Anthony_E]

Hello Wietse,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[robert_espi]

Hi,

I had this same concern. Contacted TAC as i believed it was a false positive. They checked it out and flagged it as clean on their database so it was resolved. 

[Wi3tse]

Hi Robert,

I also opened a case at TAC for these files.

They assured me that the files are now flagged clean (we already whitelisted in EMS)

What I do not understand is why the sandbox flags files as malicious when they are signed by Microsoft. If they just flagged the files as clean, and leave everything the same, it means it can happen again on other (maybe more crucial) files from Microsoft or Intel, even if you excempt those file for sandboxing.

So there are actually two things.

- The file is flagged by the sandbox, which causes issues.

- The file is flagged by the sandbox, which should not happen.

No answer on the second point is detrimental for my confidence in the (configuration of) the FortiFabric.