topic Prevent Credential Phishing with UPN (userPrincipalName) in Next-Generation Firewall Discussions

Prevent Credential Phishing with UPN (userPrincipalName)

fhu_omi — Wed, 29 Jun 2022 09:14:41 GMT

Hi World,

I'm have my first contact with this Prevent Credential Phishing feature. With the option "IP User", because UserID Mapping is already in place, i'm able to detect sAMAccountName Username submissions. But a lot of phishing sites are focused on the UPN, but the UPN username filed submission is not detected by the firewall.

sAMAccountName is our primary Username in the group mapping settings and alternate Username 1 is the UPN.

If possible how can we detect username fields submissions with UPN or sAMAccountName. Perhaps it is possible with Domain Credential Filter setting, but we do not have an RODC at the moment, but if it is the only option to cover both username types, the i'm also happy to know that.

I hope somebody can help, the PAN documentation does not cover this topic.

Kind regards

Re: Prevent Credential Phishing with UPN (userPrincipalName)

aleksandar.astardzhiev — Fri, 22 Jul 2022 16:49:44 GMT

Hi @fhu_omi ,

Have you consider the option to create additional Group-Mapping profile with UPN as primary username.

And configure Credential Protection with "User Group Mapping" setting.

Re: Prevent Credential Phishing with UPN (userPrincipalName)

fhu_omi — Mon, 15 Aug 2022 13:35:19 GMT

Hi @aleksandar.astardzhiev ,

this does not work see kb https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFQCA0 is written: When multiple group-mappings are configured with same base dn or ldap server, each group-mapping must include non-overlapping groups i.e include group list must not have any common group.

But for test purpose, you need to considering, that not every web serivce is protected by the user credential protection. If the traffic is classified as one of the following services, then user credential prevention does not pop in:

https://live.paloaltonetworks.com/t5/customer-resources/trusted-app-ids-that-skip-credential-submission-detection/ta-p/183595

i test on facebook login site, which is protected by the pan user cred prevention. i have a UPN estuser1@testdomain.com and SAM testuser1.

And PAN blocks as soon the string testuser1 is seen in a username field:

testuser1 -> detected

testuser1@ -> detected

testuser1@testdomain.com -> detected

testuser1@blabla.com -> detected

testuser12 -> not detected

testuser12@ -> not detected

i looks like, the domain is not checked for this Group Mapping credential submit method.

I need now to setup a RODC to check the behaviour with the Domain Credential Filter method.

Kind regards