topic Re: Signature Questoin - New Malware Affecting Cisco Devices - SYNful Knock in General Topics

Signature Questoin - New Malware Affecting Cisco Devices - SYNful Knock

Baber.Pervez — Fri, 18 Sep 2015 16:21:35 GMT

Please review the following white paper produced by Mandiant.
This also has SNORT rules attached.

https://www2.fireeye.com/rs/848-DID-242/images/rpt-synful-knock.pdf

Question: Has Palo Alto produced a signature update for their IPS/Firewall devices to catch this type of attack/malware?

If so, can you please provide details.

Thank you,

Baber

Re: Signature Questoin - New Malware Affecting Cisco Devices - SYNful Knock

fcasido — Thu, 22 Oct 2015 21:25:24 GMT

Yes. There is a signature update.

Version 530 Dynamic update

https://downloads.paloaltonetworks.com/content/content-530-2928.html?__gda__=1445592239_7da51703d85d90ba5933b7f3557bce0c