Emotet alert on SIEM ! | Closed as false positive ?! | Are we being tricked ? |

Hello, so I caught an alert on a SIEM with the title "Succesful malicious connection " .

Source IP was ok but Destination IP was flagged as malicious by 17 vendors on VirusTotal although SpamHause got no results as malicious.

The Virustotal community talked about Emotet and RCE so I reported the alert to my superiors.

They closed it after 1 hour as a false positive with the comment that " destination IP is a religious site in Serbia " …

alert cybersecurity emotet false positive siem