topic Threat ID for Unsafe Characters in URLs in Advanced Threat Prevention Discussions

Threat ID for Unsafe Characters in URLs

adcar — Tue, 16 Jan 2018 08:47:04 GMT

Is there a Threat signature to detect Unsafe/ Illegal characters in an URL? I've searched the ThreatVault but I couldn't find any unfortunately.

For clarity this is what I'm talking about - https://perishablepress.com/stop-using-unsafe-characters-in-urls/

As anyone been able to find a signature for this (without using a custom signature)?

Thank you

Re: Threat ID for Unsafe Characters in URLs

bvandivier — Tue, 16 Jan 2018 15:53:06 GMT

We do not have a broad or generic Threat ID to cover "unsafe" characters. If there are particular URL related characters a customer would like to block our recommendation would be that they create their own custom signature to detect, alert, block, etc.

https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Creating-Custom-Application-and-Threat-Signatures/ta-p/58569

Re: Threat ID for Unsafe Characters in URLs

bernicesmith — Fri, 19 Jan 2018 10:53:18 GMT

hi,

yes you are absolutely correct.