topic Re: Detecting a lot of spyware, 13190 (Smoke.Loader Command And Control Traffic) in General Topics

Detecting a lot of spyware, 13190 (Smoke.Loader Command And Control Traffic)

mfcuns — Tue, 17 Jul 2012 23:20:22 GMT

I have a user that's triggering this alert frequently when doing normal Internet browsing. Some detections are to bbc.com and other news outlet sites.. Nothing obvious comes up when analyzing the computer, so I was wondering if I could find out exactly what this signature is looking for. I already checked the Threat Vault and it only provided the same information my PA device did. Thanks in advance!

Re: Detecting a lot of spyware, 13190 (Smoke.Loader Command And Control Traffic)

zarina — Wed, 18 Jul 2012 17:47:15 GMT

Hello,

This might be a case of false positive. Please open a Support case with the tech support and pcaps as suggested in the document so that we can further look into this.

https://live.paloaltonetworks.com/docs/DOC-2769

Thanks!

Sri

Re: Detecting a lot of spyware, 13190 (Smoke.Loader Command And Control Traffic)

robertb — Tue, 31 Jul 2012 18:12:29 GMT

What was the result of the Smoke.Loader spyware. We also saw a significant number of matches to this signature around July 5th/6th and nothing since then.