Custom Vulnerability (.DMG)

nickcx1 — Thu, 06 Mar 2014 15:58:09 GMT

Hi All,

PanOSS 5.0.10

The following site (amongst others) hosts a malicious file that I want to block: Download Genieo. The file is a .dmg and I want it blocked to my Mac user estate. Rather than block the URL I thought I would give Custom Signatures > Vulnerability a go. I am following the document Creating_Custom_Signatures-RevA (page 43).

File name is InstallGenieo.dmg with Hex of

0000000: 789c 730d 6262 6060 883f cf30 0a46 2400 x.s.bb``.?.0.F$.

0000010: 0087 f401 c878 9ced d43b 0ac2 4010 06e0 .....x...;..@...

0000020: 8885 d7f0 0e1e 20da 888d 10f0 004b c020 ...... ......K.

0000030: 8baf

I have created a custom vulnerability Configuration like so:

and Standard Signature, And Condition (Transaction) like so:

Once pushed from Panorama to my devices I don't see it in the logs as Alerting. I'm sure I'm missing something but being my first attempt, I'm not sure where. Should I add it to the Vulnerability Protection under Security Profiles or something..? Or am I doing this incorrectly in the first place...?:)

Any hints would be great,

Thanks

Re: Custom Vulnerability (.DMG)

prb — Thu, 06 Mar 2014 21:12:51 GMT

I am not an expert to say if the definition is correct.

Nonetheless you need the security profile in the security policy.

Re: Custom Vulnerability (.DMG)

mbutt — Thu, 06 Mar 2014 21:53:22 GMT

I think it would be best if you post the same thread in DevCenter as developer and other users expert in this answer on that community.

Hope this helps you find the answer.

Thank you

Numan

topic Re: Custom Vulnerability (.DMG) in General Topics

Custom Vulnerability (.DMG)

Re: Custom Vulnerability (.DMG)

Re: Custom Vulnerability (.DMG)