topic Re: Threat ID 30852 and 35107 - HTTP /etc/passwd Access Attempt in General Topics

Threat ID 30852 and 35107 - HTTP /etc/passwd Access Attempt

gafrol — Wed, 09 Apr 2014 08:39:53 GMT

Is this a duplicate or does anybody know what the difference between those two Threat ID's is ?

Cheers Roland

Re: Threat ID 30852 and 35107 - HTTP /etc/passwd Access Attempt

KiCheon.Lee — Wed, 08 Jul 2015 08:20:33 GMT

Did you find it out why there are two threat IDs?

If yes, please let me know it.

Thanks,

KC Lee

Re: Threat ID 30852 and 35107 - HTTP /etc/passwd Access Attempt

mmmccorkle — Wed, 08 Jul 2015 18:57:52 GMT

Hey Gafrol and cheon

They both share the same internal bug ID 45996.

According to the notes, they found three different variations of this vulnerability and split it into three different threat IDs. 30852 35090 and 35107. This was shipped out with content version 337. Yes, the cover the same threat but cover different variations, apparently.

Thanks!

Re: Threat ID 30852 and 35107 - HTTP /etc/passwd Access Attempt

KiCheon.Lee — Fri, 17 Jul 2015 06:40:32 GMT

Hello mmmccorkle,

Thanks for your kind answer.

I have a question more deep.

What about below threats?

1) RIG Exploit Kit Detection (36683, 37561)

2) WGeneric.Gen Command and Control Traffic (13621, 14210)

3) Suspicious.Gen Command And Control Traffic (14035, 14137, 14155)

4) ANGLER Exploit Kit Detection (37744, 37796)

These threat-IDs are also same each other.

Thanks,

KC Lee

Re: Threat ID 30852 and 35107 - HTTP /etc/passwd Access Attempt

Aryanto — Sat, 31 Dec 2022 09:24:55 GMT

What about below threats?

1) RIG Exploit Kit Detection (36683, 37561)

2) WGeneric.Gen Command and Control Traffic (13621, 14210)

3) Suspicious.Gen Command And Control Traffic (14035, 14137, 14155)

4) ANGLER Exploit Kit Detection (37744, 37796)

Do you have any of those Threat ID Guide or Definition, it's will make me easeir to understand the Threat.

Re: Threat ID 30852 and 35107 - HTTP /etc/passwd Access Attempt

BenHA2D — Sun, 19 Feb 2023 15:46:04 GMT

Good day, Men! I'm new to the group and I'll be using this thread to keep tabs on any developments about the creation of duplicate Threat IDs; for the life of me, I can't figure out how to get a second Threat ID. @zinitevi

Re: Threat ID 30852 and 35107 - HTTP /etc/passwd Access Attempt

NikhilKulkarni — Tue, 21 Nov 2023 15:57:56 GMT

HI,

I have a query: why was this alert ('HTTP /etc/passwd Access Attempt' generated by PAN NGFW) triggered?