C2 threat Wgeneric.aazufa (threatid 269587899)

Reply
djr
L3 Networker

C2 threat Wgeneric.aazufa (threatid 269587899)

I am seeing this traffic on my network from a particular user so thought I would just check out a bit about it, but I can't find any reference to aazufa on the web (via google) other than the threat vault entry.

 

How come there is a threat which no-one seems to have heard of, and if Palo have made up the name, why doesn't the threat vault give the well-known name for the malware?

L7 Applicator

Re: C2 threat Wgeneric.aazufa (threatid 269587899)

Hello,

What the PAN does is look at behaviour. Looks like the traffic got flagged but if you look at the name it has 'generic' in it. Meaning the PAN thought it looked suspicious and it should be checked out further.

 

Hope that helps.

djr
L3 Networker

Re: C2 threat Wgeneric.aazufa (threatid 269587899)

Thanks for the reply, it's the "looking into further" bit I was struggling with because "aazufa" doesn't seem to be a recognised virus/threat name according to Google and Palo don't publish any details saying why they think this is suspicious, so all the Palos are saying to me is "we think there's something fishy here and we have assigned a random string of characters to it which have no meaning at all"

It's not the first time I have had this and it's frustrating that Palo set up these signatures and detect "stuff" but there's no way to find out more about it so either I completely ignore the alerts and just accept the recommended behaviour or I completely ignore the alerts and let the traffic through.  The threat vault needs more information. 

L7 Applicator

Re: C2 threat Wgeneric.aazufa (threatid 269587899)

Hello,

To be honest, I also struggle with the 'generic' ones. What I usualy do is get a pcap of the traffic and submit a ticket for support to take a look. It could be a false positive. I have my policies set to grab extended pcaps of the traffic automatically.

 

Regards,

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!