topic Suspicious User-Agent Strings in Advanced Threat Prevention Discussions

Suspicious User-Agent Strings

Jerome.j — Fri, 29 Dec 2023 09:11:38 GMT

Hi All,

I have noticed a log from our Palo Alto vulnerability report that looks suspicious yet I am unaware of it.

There is a threat "Suspicious User-Agent Strings" detected under the "spyware" category and "HTTP-proxy" application from Globalprotect VPN user IP to our LAN "squid proxy server".

Please help me understand this traffic and if is there any action that needs to be taken on this.

Thanks,

Jerome

Re: Suspicious User-Agent Strings

JayGolf — Wed, 03 Jan 2024 05:01:49 GMT

Hi @Jerome.j ,

If you can, I would recommend running a pcap on the suspicious traffic from the GP user connecting to your LAN and entering the threat ID into the Threat Vault. Follow up with the source user and investigate what the intent of this traffic is. It's possible that a user can be making suspicious web requests to your proxy or it can be a false positive. I'd also make sure to continue to monitor for related events. The only way to really tell is by diving into what the capture provides.

Good luck!