topic Re: Help With Custom Datafield or Vulnerability in General Topics

Help With Custom Datafield or Vulnerability

SDorsey — Mon, 25 Aug 2014 19:53:18 GMT

I have a Snort rule for a specific network activity I wish to either block or alert on. I would like to translate this into a PAN. Would it be best to do a data field or a vulnerability?

alert tcp any any -> any any (content:"|6E|"; depth: 1; content:"|36 36 36 58 36 36 36|"; offset: 3; depth: 7; msg: "Beacon C2"; sid: 1000000001; rev:0)

Re: Help With Custom Datafield or Vulnerability

hshah — Mon, 25 Aug 2014 19:57:48 GMT

Hello Mackwage,

It would be difficult to find exact match for snort policy because in PANW you can specifiy source IP/Port/zone, destination IP/Port/zone and application.

You may have to create custom signature for the application and than call that application in to policy.

Please provide more information on the field of snort, so I can help you with custom signature.

Regards,

Hardik Shah

Re: Help With Custom Datafield or Vulnerability

SDorsey — Mon, 25 Aug 2014 20:00:40 GMT

The main goal is to find this traffic pattern and either alert or block. "36 36 36 58 36 36 36" (regardless of application or port). Does that help?

Re: Help With Custom Datafield or Vulnerability

hshah — Mon, 25 Aug 2014 20:01:48 GMT

Hello Mackwage,

I got information, give me couple of minutes to find out solution. I think its very much doable with PANW.

Regards,

Hardik Shah

Re: Help With Custom Datafield or Vulnerability

HULK — Mon, 25 Aug 2014 20:02:47 GMT

You may refer these DOC:

Custom Application Signatures

Creating Custom Threat Signatures

Thanks

Re: Help With Custom Datafield or Vulnerability

hshah — Mon, 25 Aug 2014 20:05:25 GMT

Hello MAckwage,

It should be easily doable with Object > Security Profile > Data Filtering.

In Data Filtering, you have leverage to specify different kind of patterns.

Please refer following document for data filtering.

https://live.paloaltonetworks.com/search.jspa?q=data+filtering

Let me know if this helps.

Regards,

Hardik Shah