topic Re: Custom Vulnerability Signature. Is this limitation correct or is a fail? in General Topics

Custom Vulnerability Signature. Is this limitation correct or is a fail?

SOC_CSG — Wed, 23 Sep 2015 09:21:43 GMT

Hello

I've been trying to create a custom vulnerability and I have encountered this limitation:

Currently in Threat Database Vault 529 version there are 50 signatures for PHP.

I'm trying to add all PHP signatures and this message appears when it exceeds 17 signatures.

😞

Is this limitation correct or is a fail?

😞

A few days ago we suffer multiple PHP vulnerability scanning in our web servers:

The source IP 188.78.195.67 is in many blacklists.

I would like to create a custom signature for IP auto-block attacker for 1 hour, if 10 times in 10 seconds any PHP Scan Vulnerability.

Thanks and regards,

dicu

Re: Custom Vulnerability Signature. Is this limitation correct or is a fail?

OtakarKlier — Wed, 23 Sep 2015 14:36:40 GMT

Hello,

I'm not sure on the custom Vulnerabilities issue, perhaps a support case is in order? However if the IP is on many lists, have you considered Dynamic Block Lists?

https://isc.sans.edu/forums/diary/Subscribing+to+the+DShield+Top+20+on+a+Palo+Alto+Networks+Firewall/19365/

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Dynamic-Block-List-DBL-or-External-Block-List/ta-p/53414

Just a thought.

Re: Custom Vulnerability Signature. Is this limitation correct or is a fail?

HITSSEC — Mon, 12 Oct 2015 01:34:13 GMT

Hello

To address the limit of 16 patterns you just need to add another signature as shown below:

Each signature can have 16 "or" values. I have signatures that have +50 string patterns

Hope this helps.

Phil

Re: Custom Vulnerability Signature. Is this limitation correct or is a fail?

SOC_CSG — Tue, 13 Oct 2015 07:49:54 GMT

Hello

First of all thanks for your answer Otakar.Klier.

About "Dynamic Block List" I already knew and I already had put to work this in any of our clients.

I think it is a correct answer.

But first I would like to try every option that gives the IPS Palo Alto and one of these are the "Custom Vulnerability Signature".

It is a way to demonstrate the potential of Palo Alto firewalls.

Regards,

dicu

Re: Custom Vulnerability Signature. Is this limitation correct or is a fail?

SOC_CSG — Tue, 13 Oct 2015 08:17:47 GMT

Hello HITSSEC

I don't understand.

I think you mean to use patterns instead of signatures.

I think it might work but what are the patterns of each firm? or where can I find them?

https://threatvault.paloaltonetworks.com/

Note that currently in Threat Database Vault 529 version there are 50 signatures for PHP.

Thanks and regards,

dicu

Re: Custom Vulnerability Signature. Is this limitation correct or is a fail?

HITSSEC — Thu, 15 Oct 2015 14:48:02 GMT

The signature can have multiple sets of patterns. Each set of patterns (max 16) can be "or" conditions. The pattern string can be for specific purposes such as misuse of access to PHP related resources.

Does this add any clarity or am I missing something.

Phil