st3213

Thanks @Zyxel_James. I think the worry comes from the fact that not only a log entry is generated (which is fine) but also an alarm is risen and an alert emails sent out immediately. We receive a lot of alarm emails from our systems due to "Abnormal TCP flag attack" - more serious issues can be overseen in this situation.…

Any update on this? We experience the same on some devices. Any countermeasures?

Hi @Zyxel_Kevin, unfortunately, the issue is still prevalent on our USG 500 flex. False positives still happen every month on MS patch day! It often involves some kind of dotnet-runtime-file, today it was the Update KB5023288. The Hash is 28F846B09CB2CFE30ADDFC2731853AF9. You really should look at this - adding files to…

@Zyxel_Kevin Thank you for updating the signatures, hits have stopped not. But we need to keep this open at least until the next MS patch day. Let's hope for a permenent solution.

OK, I see. We have an additional column in our 500 flex devices. But otherwise, the same: We get hundreds of hits on every patch day. Interestingly, the alters stop after a while - not sure if ZyXel is updating signatures or why. I'm just wondering why there is no more talk about this issue. One would assume that many…

OK, I see. We have an additional column in our 500 flex. I Hope @Zyxel_Kevin can advise. The problem is going on for a while now.

OK, I see. We have an additional column in our 500 flex devices. But otherwise, the same: We get hundreds of hits on every patch day. Interestingly, the alters stop after a while - not sure if ZyXel is updating signatures or why. I'm just wondering why there is no more talk about this issue. One would assume that many…

you could check monitor --> security statistics --> anti-malware --> Hash values in the table. As I mentioned, unfortunately, there is no direct linkage to the alert from the system log.

Hi Kevin, the same happens here on USG 500 flex. In fact, it happens every patch day for the last couple of months - which is quite annoying as it generates a load of alerts. For the current patch day, I'm copying the virus name and filename below: dotnet-runtime-6.0.11-win-x64_3504dfca92911ac7449dcb292a33b75f8Malicious…