topic Re: Zero Access question in General Topics

Zero Access question

Fred_Zierold — Thu, 19 Mar 2015 19:49:58 GMT

Hi,

I am new to this website, so I apologize if this is in the wrong location.

Can someone clarify for me what the ZeroAccess alert in the Palo Alto is triggering upon? How do I review the signature?

Thank you for you assistance.

Re: Zero Access question

Dz3015 — Thu, 19 Mar 2015 20:06:41 GMT

Depending on which ID it is giving you, you can look in the threat vault for a description:

https://threatvault.paloaltonetworks.com/

For example, here is a listing for the first ID (13298):

https://threatvault.paloaltonetworks.com/Home/ThreatDetail/13298

Re: Zero Access question

hshah — Thu, 19 Mar 2015 20:22:20 GMT

Hi Fred,

End user has no access to signatures. "ZeroAccess" is a category where Trojan Horse hides itself. PANW can verify each exe if proper policies are applied. And can detect Trojan hourse.

Provide me more specific detail query on "ZeroAccess Alert".

Regards,

Hardik Shah

Re: Zero Access question

Fred_Zierold — Mon, 23 Mar 2015 17:06:54 GMT

This is the alert we are seeing. I just want a better idea what it is triggering on. We had another system which gave us many many false positive ZeroAccess alerts. Before I start pulling computers for malware analysis, I want to find out what is causing this to trigger.

Thanks.

Name:	ZeroAccess.Gen Command and Control Traffic
ID:	13235
Description:	This signature detects ZeroAccess.Gen Command and Control Traffic.

Re: Zero Access question

hshah — Mon, 23 Mar 2015 17:13:32 GMT

Hi Fred,

System is under botnet attach, please refer following link.

https://threatvault.paloaltonetworks.com/Home/ThreatDetail/13235

Let me know for additional query.

Regards,

Hardik Shah

Re: Zero Access question

hshah — Mon, 23 Mar 2015 17:17:04 GMT

Hi Fred,

13235 is a generic botnet detector. It is typically triggered with requests to known Command & Control (C&C) servers, hostnames, or IPs. Please find more information.

https://threatvault.paloaltonetworks.com/Home/ThreatDetail/13235

A full AV scan of the affected machine would likely show results, as long as any associated malware has not disabled the AV scanner.

Regards,

Hardik Shah

Re: Zero Access question

Fred_Zierold — Mon, 23 Mar 2015 17:59:50 GMT

I think this is a false positive. I just spoke with the person whose computer this is and it was reimaged for zeroaccess over a month ago. Yet the alerts are continuing.

I spoke with the original analyst on the case and he feels this alert is generating alerts on inbound traffic. The Palo Alto screen shows that our computer is attacking, however upon packet review the inbound traffic is causing the alert.

Hshah do you work for PA?

Re: Zero Access question

hshah — Mon, 23 Mar 2015 18:12:01 GMT

Hi Fred,

In Threat log direction should be "server-to-client", if yes. Than it means attacker is on internet.

If you think its a false positive, than you might want to create exception for that. Let me know if you need any help with that.

Regards,

Hardik Shah

Re: Zero Access question

Dz3015 — Mon, 23 Mar 2015 19:06:54 GMT

Fred,

sounds right. Perhaps the system is still on client lists for the C&C servers so they are still attempting to communicate. Does that system have it's own public IP?