topic Re: Tracking an infected computer in General Topics

Tracking an infected computer

ToddJohnsen — Fri, 03 Jan 2014 20:18:22 GMT

I got a notice from my ISP that we have a Conficker infected system (downadup) but I am coming up with nothing when I try to find it. The less than helpful info I recieve is the first octet of the target IP (38) and source port 61494, which map to hundreds of system. I also have a destination port of 80, again very helpful. The firewall is NATing for about 2000 systems. Has anyone used their panos box to track a system before and if so what did you do? We have ESET deployed for anti-virus and it is not showing anything right now. We could be missing a system though. I am still fairly new to my PA-3020 box so use small words please.

I have been using the threat log and tried the pre-built reports. The Monitor Logs are amazing but I can't seem to narrow the search enough to find the problem. I only have the URL filter and threat prevention license on 5.0.9

Thanks,

Todd

Re: Tracking an infected computer

HULK — Fri, 03 Jan 2014 21:28:36 GMT

Hello Todd,

Is there any related information pops up under Monitor > Threat logs...?

Also please apply below mentioned command to stop suppressing repetitive logs on PAN FW.

# set deviceconfig setting logging log-suppression no

Thanks

Re: Tracking an infected computer

_slv_ — Sat, 04 Jan 2014 17:23:56 GMT

Hello Todd

The simplest way is to make a filter in Thread log

I'm not sure that every variant of Conficker has 12544 id, so You can remove "and ( threatid eq 12544 )"

Of course You mast have Thret prevention profile added to security rule that is allowing traffic from You networks to Internet.

Regards

SLawek

Re: Tracking an infected computer

ToddJohnsen — Tue, 07 Jan 2014 19:55:59 GMT

Thanks SLawek,

I finally figured it out with your help. I ran the Threats report and found all the Suspicious DNS Query results I had been unable to find before. Each one has a different ID code that I was able to search for in the Threat log as you describe with great success. Looks like I should be able to trace this after all.

-Todd