topic Re: Sipvicious.Gen User-Agent Traffic in General Topics

Sipvicious.Gen User-Agent Traffic

martinriveran — Fri, 14 Nov 2014 01:14:04 GMT

Hello everyone,

This is my first post here. So i started a new job couple months ago and we have a PA 3050 . The daily reports is showing Sipvicious.Gen User-Agent Traffic coming from IP's all over the world.

Any ideas?

Thanks

Re: Sipvicious.Gen User-Agent Traffic

bat — Fri, 14 Nov 2014 01:18:29 GMT

Hi martinriveran

Welcome to forums !

I think you are talking about threat 13272 Sipvicious.Gen User-Agent traffic, this threat detects SipVicious User-Agent traffic in SIP request headers : https://threatvault.paloaltonetworks.com/Home/ThreatDetail/13272

You might have SIP packets coming in with SipVicious user-agent traffic in the headers.

Hope it helps !

Re: Sipvicious.Gen User-Agent Traffic

HULK — Fri, 14 Nov 2014 01:18:35 GMT

Hello martinriveran ,

Could you please provide some more detail information regarding this threat.

You can go to Web-UI of the PAN firewall and open Monitor > Logs > Threat. Open the threat and take a snapshot.

Thanks

Re: Sipvicious.Gen User-Agent Traffic

hshah — Fri, 14 Nov 2014 01:22:32 GMT

Hi martinriveran,

Do you trust source and destination of VOIP traffic. If yes, this might be a potential false positive and you can ingore it.

Regards,

Hardik Shah

Re: Sipvicious.Gen User-Agent Traffic

martinriveran — Fri, 14 Nov 2014 01:24:26 GMT

It is the 13272 indeed.

Re: Sipvicious.Gen User-Agent Traffic

HULK — Fri, 14 Nov 2014 01:28:01 GMT

Is the victim and attacker address is trusted IP addresses on your network...? If so, then it might be a false positive and you can add an "exception" to your vulnerability profile to avoid such logs in future. But, if those addresses are unknown, then you may open a support ticket to verify the traffic/signature.

Hope this helps.

Thanks

Re: Sipvicious.Gen User-Agent Traffic

HULK — Fri, 14 Nov 2014 01:30:28 GMT

Since, this is SIP traffic, please check address with Call-manager and EPBX address.

Thanks

Re: Sipvicious.Gen User-Agent Traffic

martinriveran — Fri, 14 Nov 2014 01:34:18 GMT

The attacker IP's are unknown...
Also this a DC. There should be no SIP traffic at all....

Thanks for all the help!

Re: Sipvicious.Gen User-Agent Traffic

bat — Fri, 14 Nov 2014 01:35:23 GMT

martinriveran

The above threat just checks for the User-Agent "friendly-scanner" in the SIP headers. For more information about SipVicious: The Less Than Friendly-scanner, Sipvicious

Again if you do not trust the source of this traffic you can create an exception and change the action from alert to block:To create an exception follow this document:https://live.paloaltonetworks.com/docs/DOC-3699

Hope it helps !

Re: Sipvicious.Gen User-Agent Traffic

hshah — Fri, 14 Nov 2014 01:55:27 GMT

Hi Martin,

Is Victim a Domain Controller? If you dont expect a SIP traffic on Domain controller than do further investigation.

Regards,

Hardik Shah

Re: Sipvicious.Gen User-Agent Traffic

martinriveran — Fri, 14 Nov 2014 02:29:38 GMT

This is a DC environment where they should be no SIP traffic at all...that is the weird thing....
The way our PA is setup is only a tab...so not inline.

Agan, i really appreciate everyones help