topic Re: Frustration with threats from PA in General Topics

Frustration with threats from PA

ericgearhart — Mon, 05 May 2014 20:01:25 GMT

Is anyone else frustrated with PA's approach to threats and threat signatures?

Prime example: "Netbios Small Piece Data Evasion Attack Vulnerability" - signature ID 33511, link to the Threat Vault: https://threatvault.paloaltonetworks.com/Home/ThreatDetail/33511

Can we please get some kind of an idea of what the heck this is in reference to? A Microsoft KB? Some kind of hint about figuring out if this is a FP or not? Google searches for "Netbios Small Piece Data Evasion Attack Vulnerability" turn up a link to Microsoft KB that's no longer valid.

Re: Frustration with threats from PA

HULK — Tue, 06 May 2014 07:38:24 GMT

The signature 33511 will be triggered if there are two netbios packets which length is less than 4 bytes in one session. Some evasion techniques will use this method to get rid of detection, but this signature itself is not a vulnerability.

This is just an indicator that PAN find some evasion packet. It not means it is malicious.

Hope this helps.

Thanks

Re: Frustration with threats from PA

ericgearhart — Tue, 06 May 2014 13:43:16 GMT

Thanks HULK, that does indeed help