Finding Rootkits in Palo Alto

CarbonAlligator — Tue, 18 Mar 2025 03:32:47 GMT

I was looking for information on finding and removing rootkits on Palo Alto, using the CLI commands. Reinstalling PANos isn't an option for me, but any help would be greatly appreciated. I know there is a rootkit installed, but I am not entirely sure what it does, beyond bricking the firewall when upgraded to a new base version.

Re: Finding Rootkits in Palo Alto

ozheng — Wed, 19 Mar 2025 05:51:45 GMT

Hello @CarbonAlligator ,

If you want to know what the rootkit does, you can engage Unit42 or any other vendor to assist in performing the forensics / analysis.

Regarding the device itself, from a security perspective, you SHOULD consider to factory reset the device.
(you get bitten by the snake, you don't wait to know if the snake was venomous or not, you rush to hospital or try to remove if possible the venom)

Olivier

topic Re: Finding Rootkits in Palo Alto in Next-Generation Firewall Discussions

Finding Rootkits in Palo Alto

Re: Finding Rootkits in Palo Alto