Advanced Threat Prevention Discussions

Welcome to the Threat & Vulnerability Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

CVE-2022-0778 mitigation with Threat Prevention

Hi, Following the CVE-2022-0778 vulnerability, I would like to apply the workaround to reduce the risk of attack until the PAN-OS update is released. According to the security ticket, you have to activate the Threat IDs 92409 and 92411 but how to do it ? I found this link but I'm not sure of the procedure: https://knowledgebase.paloaltonetworks....

CVE-2022-0778 OpenSSL infinite loop vulnerability

CVE-2022-0778 Impact of the OpenSSL Infinite Loop Vulnerability CVE-2022-0778 (paloaltonetworks.com) Further to this one, it mentions that Globalprotect is affected but doesnt say whether a client software update is required.Do you know if the Globalprotect client will need updating?

policy, objects and smtp

howdy,I can not get my head around how to do this.Allow smtp from a country but block every other service, application.You can negate countries but not services/applications.can one do any/any with an exception?Thank you

Threat Signature Pattern Lookup

How can I lookup what pattern(s) a particular threat signature is looking for?

Wildfire and Vulnerability Protection Signatures

The Wildfire engine obviously has a large impact on AV signatures, URL-Filtering categorization, and DNS Security, but I was curious if it plays any part at all in creating new vulnerability protection threat IDs? If not, then are new IDs created solely on new public CVEs, PoCs, and Unit 42 threat research investigations?

Signatures or Definition files

I have learned of a vulnerability from our security team with a file named "trello.dll". Is there a way to know what is covered in the signatures and definitions?

How to Block RClone

If I search for rclone in the applications on my PAN 3220 w 9.1, I am not spotting "rclone". Is there a means of identifying and blocking rclone traffic? https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/

Palo Alto Networks PAN-OS 8.1.x / 9.0.x / 9.1.x / 10.0.x Improper Input Validation

Hi All,I would like to verify some vulnerability as in PAN OS Advisory for "Low- PAN-OS 8.1.x / 9.0.x / 9.1.x / 10.0.x Improper Input Validation"Also there are detected by Nessus scanner for "High- SQLi scanner and low- Auto completion finding". Is it these vulnerabilities detected will be resolved if we upgrade to PAN OS 10.1.4 version?

PoshC2 false positive

Hello,We are seeing what appears to be false positive detections for the PoshC2C vulnerability signatures that was released recently. Connections going to Google and BBC, is anyone else seeing the same thing here?

Resolved! Detection of Critical Vulnerabilities, what does it mean ?

Hi All,When Palo alto firewall detects a vulnerability ( in the ACC tab, threats widget ), what does it mean exactly?( The source IP is private IP and destination is a public IP )1.Does it mean that the server is infected and is sending out traffic to some malicious IP. 2.Does it mean that the server is not infected but it contains software whic...

URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions (panos-cve-2020- 2035)

while scanning getting this vulnerability. the CVE no is mentioned, it is not helping to close the gap. need your support pls

Virus/Win32.WGeneric.cfzcwn False/Positive?

Received multiple alert for comms between two systems triggered by virus signature ( date of released on 3/3/2022). Anyone else received these, is it false/positive?Name: Virus/Win32.WGeneric.cfzcwnUnique Threat ID: 468826517Create Time: 2022-02-03 11:48:01 (UTC)Hash: ab19a2c1a7621f777185863c0789e2045d2cc8b61958b26cbaa9483f4dd5aaf8 Virus Total i...

Resolved! Is it required that Panorama Devices have Dynamic Updates scheduled ?

Our firewalls managed by Panorama are updated daily but the Panorama device itself isnt scheduled to be updated. Is this required ? Will the ACC tab on Panorama show the latest threats found on firewalls etc only if itself is updated ?

No entry in the User-Agent field in threat logs

Hi All, We had recently got threat log entries on the PA firewall. While checking the logs the Browser "User-Agent" column in the threat field is empty. While reading the documentations it is advised that this filed will be populated only for HTTP traffic. We had Web-Browsing in the application field and traffic being destined to destination por...

Block on APP-ID (Apache Log4j )

Hello All,After a bit of help ...I' have never created a block type rule on a Palo and now my boss wants me to create a .block rule for the above.We have about 300 policies in the our firewall so no idea how to create a block and apply it .Can anybody give me any pointers ? Regards

Discussions

Welcome to the Threat & Vulnerability Discussions!

CVE-2022-0778 mitigation with Threat Prevention

CVE-2022-0778 OpenSSL infinite loop vulnerability

policy, objects and smtp

Threat Signature Pattern Lookup

Wildfire and Vulnerability Protection Signatures

Signatures or Definition files

How to Block RClone

Palo Alto Networks PAN-OS 8.1.x / 9.0.x / 9.1.x / 10.0.x Improper Input Validation

PoshC2 false positive

Resolved! Detection of Critical Vulnerabilities, what does it mean ?

URL filtering policy is not enforced on TLS handshakes for decrypted HTTPS sessions (panos-cve-2020- 2035)

Virus/Win32.WGeneric.cfzcwn False/Positive?

Resolved! Is it required that Panorama Devices have Dynamic Updates scheduled ?

No entry in the User-Agent field in threat logs

Block on APP-ID (Apache Log4j )

Upgrade from Basic Threat Prevention to Advanced Threat Prevention

PAN-OS logs

Are there signature release for following vulnerabilities?

Cannot update Adobe Creative Cloud

App & Threat Content Comparison Utility

Unlock your full community experience!

Resolved! Detection of Critical Vulnerabilities, what does it mean ?

Resolved! Is it required that Panorama Devices have Dynamic Updates scheduled ?