topic Re: JS/Exploit.pdfka.iiq (280954) in General Topics

JS/Exploit.pdfka.iiq (280954)

jam1 — Tue, 03 Sep 2013 15:23:02 GMT

Is anyone else seeing this Virus threat ID trigger? It appears to be a false positive, but I cannot find any description in the threat vault.

Re: JS/Exploit.pdfka.iiq (280954)

HULK — Tue, 03 Sep 2013 16:39:32 GMT

At this time, only antivirus signatures for PE viruses (executables) are in the threat vault, aside from the vulnerability and anti-spyware signatures. These signatures are in the ID range of 2M – 3M. To find out additional information on the malware that the PE antivirus signatures trigger, you can search the threat vault by signature ID or name, There is no additional information available in the threat vault aside from what is already shown in the threat details dialog in PAN-OS.

We are working on a threat vault enhancement that will show additional signature types later this year. There is no firm release date for this enhancement at this time.

However, if the information for a detected virus on the Palo Alto Networks firewall is not available in the Threat Vault. Please follow below mentioned documents.

How to Find Virus Details if Not Available in the Threat Vault

https://threatvault.paloaltonetworks.com/

Thanks

Re: JS/Exploit.pdfka.iiq (280954)

jam1 — Tue, 03 Sep 2013 17:05:08 GMT

Thanks Hulk.

Re: JS/Exploit.pdfka.iiq (280954)

mikand — Tue, 03 Sep 2013 18:50:29 GMT

So in short... PA doesnt (currently) protect against Android malwares as stated by this blog entry at PA site (even if wildfire can detect such)?

Parasites Android Malware Discovered by WildFire - Palo Alto Networks Blog