topic Re: Basic Rule to Detect/Alert on OvenVas Scanners in Custom Signatures

Basic Rule to Detect/Alert on OvenVas Scanners

r_gine — Thu, 15 Dec 2016 01:23:05 GMT

So I'm surprised that the Palo Alto doesn't have a signature to detect OpenVAS scanners. I would like to create a simple rule that detects "User-Agent: OpenVAS" (Ultimately I would like to just block these entirely.

Is something that can be easily built?

Re: Basic Rule to Detect/Alert on OvenVas Scanners

goku123 — Thu, 15 Dec 2016 01:33:35 GMT

Please refer to the thread on this forum:

https://live.paloaltonetworks.com/t5/Custom-Signatures/Welcome-to-the-Palo-Alto-Networks-Custom-Signature-discussion/m-p/101020#U101020

This has an example on how to detect Nikto Scanner traffic by sigging off the user-agent:

Example 2: Detecting Nikto Scans through User Agent (Nikto User Agent.xml)

The same thing can be achieved for OpenVAS by simply modifying the value in the user-agent field in the signature to "OpenVAS".

The signature can then be used in policy to alert/block etc.

Re: Basic Rule to Detect/Alert on OvenVas Scanners

Rags — Wed, 28 Feb 2018 19:44:54 GMT

I could not get the OpenVAS signature to work by just switching Nikto for OpenVAS. I had to do a more basic string <pattern>OpenVAS</pattern> . I actually did <pattern>OpenVAS 8</pattern> at first to see if that would work, it did. (OpenVAS 8.0.9 was the user agent.

Make sure you edit the entry name if you use my .xml file. You might already have that number in use. Also created one for Baiduspider since my IDS picked it up in a scan and I saw the user agent string for it.

There's a few useful links that will show user agent strings for popular scanners/crawlers.

https://developers.whatismybrowser.com/useragents/explore/software_type_specific/crawler/9
http://www.useragentstring.com/pages/useragentstring.php?typ=Crawler

Hope that helps, thanks -Rags