topic An interesting POC using Palos in General Topics

An interesting POC using Palos

raji_toor — Wed, 10 Nov 2021 07:19:38 GMT

Just watched an interesting way of hiding C2 traffic which bypasses Palos in the demonstration. Would be good to know if there is solution to capture this.

https://www.youtube.com/watch?v=eVr0kKdgM2I

Re: An interesting POC using Palos

OtakarKlier — Thu, 18 Nov 2021 16:54:36 GMT

Hello,

I'm also curious and opened a support case to verify my theory on how to block this. However it seems that if you have say application whitelisting or a good XDR, the software performing the beacon should be caught even before it tries to beacon out.

Regards,

Re: An interesting POC using Palos

LAYER_8 — Fri, 19 Nov 2021 16:47:01 GMT

I believe this is in relation to a CVE we patched in 10.1: https://security.paloaltonetworks.com/CVE-2020-2035

Re: An interesting POC using Palos

OtakarKlier — Tue, 30 Nov 2021 19:38:56 GMT

Hello,

Would be nice to have a patch for the other code versions as well. However Support did tell me that with everything enabled, this should get caught. However I do not have a lab to test this in.

Regards,

Re: An interesting POC using Palos

LAYER_8 — Wed, 01 Dec 2021 01:22:40 GMT

Yes, the new features introduced in DNS security are able to detect/respond to this. It's on PM's agenda to backport, the Randori CVE took some engineering resources to respond to.