topic Re: C2 threat Wgeneric.aazufa (threatid 269587899) in Advanced Threat Prevention Discussions

C2 threat Wgeneric.aazufa (threatid 269587899)

djr — Fri, 26 Jul 2019 06:50:37 GMT

I am seeing this traffic on my network from a particular user so thought I would just check out a bit about it, but I can't find any reference to aazufa on the web (via google) other than the threat vault entry.

How come there is a threat which no-one seems to have heard of, and if Palo have made up the name, why doesn't the threat vault give the well-known name for the malware?

Re: C2 threat Wgeneric.aazufa (threatid 269587899)

OtakarKlier — Tue, 06 Aug 2019 21:13:19 GMT

Hello,

What the PAN does is look at behaviour. Looks like the traffic got flagged but if you look at the name it has 'generic' in it. Meaning the PAN thought it looked suspicious and it should be checked out further.

Hope that helps.

Re: C2 threat Wgeneric.aazufa (threatid 269587899)

djr — Wed, 07 Aug 2019 08:21:17 GMT

Thanks for the reply, it's the "looking into further" bit I was struggling with because "aazufa" doesn't seem to be a recognised virus/threat name according to Google and Palo don't publish any details saying why they think this is suspicious, so all the Palos are saying to me is "we think there's something fishy here and we have assigned a random string of characters to it which have no meaning at all"

It's not the first time I have had this and it's frustrating that Palo set up these signatures and detect "stuff" but there's no way to find out more about it so either I completely ignore the alerts and just accept the recommended behaviour or I completely ignore the alerts and let the traffic through. The threat vault needs more information.

Re: C2 threat Wgeneric.aazufa (threatid 269587899)

OtakarKlier — Wed, 07 Aug 2019 13:44:30 GMT

Hello,

To be honest, I also struggle with the 'generic' ones. What I usualy do is get a pcap of the traffic and submit a ticket for support to take a look. It could be a false positive. I have my policies set to grab extended pcaps of the traffic automatically.

Regards,