topic Threat ID 54532 in Next-Generation Firewall Discussions

Threat ID 54532

James123456 — Thu, 15 Dec 2022 19:20:53 GMT

Anyone have any experience dealing with Threat ID 54532? VBScript Obfuscation.

See the offenses/detections but find nothing on the hosts source or destination that reflects a vbs script. Its all internal traffic. Could it be some other traffic that is getting incorrectly labeled as VBS?

Re: Threat ID 54532

OtakarKlier — Thu, 22 Dec 2022 20:20:12 GMT

Hello,

Yes it can be other traffic as the signatures are looking for specific items in the traffic. Best way to find out would be to create a packet capture and open a support case for the support team to review it. This is because we do not have insight into the threat definitions.

Regards,