Palo Alto Threat Logs

miyaaccount — Mon, 23 Dec 2019 03:03:26 GMT

Hello, I've been getting multiple code execute with a content type "Suspicious File Downloading (54469)". I'm not really sure if this is just normal browsing or a directory scan, I can't find any documentations about this content type. May I know what it does or what happens with the traffic?

Re: Palo Alto Threat Logs

kiwi — Mon, 23 Dec 2019 09:15:29 GMT

Hi @miyaaccount ,

You can check all threat ID's in the threat vault : https://blog.paloaltonetworks.com/threat-vault/

As for TID 54469 this is the information :

Name	Suspicious File Downloading Detection
Unique Threat ID	54469
Description	This signature detects WGET and CURL command execution in HTTP request URL parameters, which is pervasively exploited by attackers to get subsequent malicious payload.
Category	code-execution
PanOS Minimum Version	7.1.0
PanOS Maximum Version
Severity	low
Action	alert
CVE
Vendor ID
First Release	8058 (2018-08-28 UTC)
Last Update	8058 (2018-08-28 UTC)
Reference
Status	released

Cheers !

-Kiwi.

topic Re: Palo Alto Threat Logs in General Topics

Palo Alto Threat Logs

Re: Palo Alto Threat Logs