C2 threat Wgeneric.aazufa (threatid 269587899)

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

C2 threat Wgeneric.aazufa (threatid 269587899)

L4 Transporter

I am seeing this traffic on my network from a particular user so thought I would just check out a bit about it, but I can't find any reference to aazufa on the web (via google) other than the threat vault entry.

 

How come there is a threat which no-one seems to have heard of, and if Palo have made up the name, why doesn't the threat vault give the well-known name for the malware?

1 accepted solution

Accepted Solutions

Hello,

To be honest, I also struggle with the 'generic' ones. What I usualy do is get a pcap of the traffic and submit a ticket for support to take a look. It could be a false positive. I have my policies set to grab extended pcaps of the traffic automatically.

 

Regards,

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

Hello,

What the PAN does is look at behaviour. Looks like the traffic got flagged but if you look at the name it has 'generic' in it. Meaning the PAN thought it looked suspicious and it should be checked out further.

 

Hope that helps.

Thanks for the reply, it's the "looking into further" bit I was struggling with because "aazufa" doesn't seem to be a recognised virus/threat name according to Google and Palo don't publish any details saying why they think this is suspicious, so all the Palos are saying to me is "we think there's something fishy here and we have assigned a random string of characters to it which have no meaning at all"

It's not the first time I have had this and it's frustrating that Palo set up these signatures and detect "stuff" but there's no way to find out more about it so either I completely ignore the alerts and just accept the recommended behaviour or I completely ignore the alerts and let the traffic through.  The threat vault needs more information. 

Hello,

To be honest, I also struggle with the 'generic' ones. What I usualy do is get a pcap of the traffic and submit a ticket for support to take a look. It could be a false positive. I have my policies set to grab extended pcaps of the traffic automatically.

 

Regards,

  • 1 accepted solution
  • 6065 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!