Advanced Threat Prevention Discussions

Welcome to the Threat & Vulnerability Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating: Rules and Best Practices Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussions are encouraged; disrespectful or inflammatory comments are not. Stay On-Topic: This board is d...

Port Scans & Telnets on a PA running 8.0

I am new to the world of PA and next gen firewalls and took some online training. I discovered that in the Traffic Proccessing phase before App ID gets applied in the Security Policy that the session is already allowed to start if the layer 4 ports are allowed in the policy. This makes me wonder if I were to run a port scan on my public addres...

Zone protection on sub interfaces

Apologies if this is going over old ground but I have an issue with zone protection and am stumped trying to work out what it is. I have configured and applied the zone protection profile to a layer3 sub-interface, when I test against it with crafted packets the majority of the configured protections flag using the following commandshow zone-pro...

Anyone know where Palo is on NAT Slipstreaming V2?

Hello,Just curious if there is a definition for the new variant referenced here: https://www.armis.com/resources/iot-security-blog/nat-slipstreaming-v2-0-new-attack-variant-can-expose-all-internal-network-devices-to-the-internet/ Thank you!

Resolved! Best practice stopping attacks from outside

I noticed the default action for the new "NAT Slipstreaming Detection" signatures are set to Alert.How come they are not set to Drop or something else that stops this attack in its tracks? Also, is there a best practice on protecting against attacks, such as this one, in general? Or does it come down to personal/company preference?For example, d...

Amazon CDN triggering lots of 38716 threats (library loading elevation of privilege)

Hello, Have anyone else noticed a very large flood of triggered 38716 threat warnings comming from Amazon CDN? That is just a very short fragment: 2018-02-26 13:301801032072THREATvulnerability2018-02-26 13:3052.222.174.180192.168.2.199Microsoft Windows library loading elevation of privilege vulnerability(38716)2018-02-26 13:301801032072THREATvul...

SMB: User password brute force

We have been seeing SMB: User Password Brute Force Attempt threats coming into our logs. We are not seeing a UN accompanied with the the traffic and the are using port 445. This just popped up recently and we are not seeing anything malicious on the client or the DC which is being reached out to. We are trying to identify what might be causin...

Minemeld service doesn't start and cannot access the web page giving 403 error

hello,we have an issue in minemeld service disabling access to the web server giving 403 error.The details is in screeshots.Any help please ?

Vulnerability block more than 3600 seconds.

Hello there, We have a constant brute force attempt on port 25 of our email server. We put the vulnerability profile to block these attacks and consequently block the ip for 3600 seconds, however in some cases this ip will try again immediately after the maximum blocking time. Is there any way to increase this type of attack for 1 day of blockin...

Block hash value

Hi Team How to block below hash value. Please help us4ad20bcd0f915acba7817e0639fcbf4f713beb8ac35112134808d4e5f753d51986800f9e3b563eaeba1d84d431b83405b2118300c0ad2deab39a093d4b9093c596a64cccb55f7b42711015054ddd6ac45459643aa17c13248c6e344dc787cbfdaad97a08a139e8dff1f02f73479a5b00ecca5b512f627082f9c589fd63479c83b3daf217ca7339ad9e738f087135af8f63fd46...

The production application triggered the "HTTP SQL Injection Attempt" threat alert, resulting in the

hi Team.Our production application triggered the "HTTP SQL Injection Attempt" threat alert, mainly ID: 33338 and ID: 36056 and ID: 36239 and ID: 54608; affecting the production business; an exception has been made, how can we determine which SQL statements triggered these threat IDs; we want to fix these vulnerabilities with such information. Th...

DLP Regex pattern does not work

hi all, I'm trying to add a regex data pattern for the word Orion. It works everywhere, but Palo Alto just refuses to except it and gives no reason. This is standard regex syntax ([oO][rR][iI][oO][nN]) I need the word "orion" in every possible combination of capital or lower case. The vendor is at a loss as well and we are stuck. Any help would...

About vulnerability protection and url filter action

I set medium to drop in the vulnerability protection profile, but when I check the log, Severity is medium, but action is alert. Why not drop? If you check the verbose log, the type is url and action is alert. Severity is informational. In this case, isn't url processing prioritized and not dropped?

To block unauthenticated inbounds connections by default.

Hello everyone,I am a newbie here. Perhaps anyone here can tell me how to set my PA-28 firewall to block unauthenticated inbounds connections by default. Thanks

Exact threat details

Hi, Is there a way to know what a specific threat ID checks for? We enabled SSL inspection for SMTP traffic and Palo started to flag every e-mail with threat ID 56951 (non-RFC compliant SMTP traffic), but ThreatDB does not provide anything useful as to what/how it is non-compliant. E-mails were received from a proper e-mail server running an o...

Nat/Firewall Bypass Attack how palo alto protect from

A new research has demonstrated a technique that allow an attacker to bypass firewall protection and remotely access any TCP/UDP service on victim machine.https://thehackernews.com/2020/11/new-natfirewall-bypass-attack-lets.html

Discussions

Welcome to the Threat & Vulnerability Discussions!

Port Scans & Telnets on a PA running 8.0

Zone protection on sub interfaces

Anyone know where Palo is on NAT Slipstreaming V2?

Resolved! Best practice stopping attacks from outside

Amazon CDN triggering lots of 38716 threats (library loading elevation of privilege)

SMB: User password brute force

Minemeld service doesn't start and cannot access the web page giving 403 error

Vulnerability block more than 3600 seconds.

Block hash value

The production application triggered the "HTTP SQL Injection Attempt" threat alert, resulting in the

DLP Regex pattern does not work

About vulnerability protection and url filter action

To block unauthenticated inbounds connections by default.

Exact threat details

Nat/Firewall Bypass Attack how palo alto protect from

Upgrade from Basic Threat Prevention to Advanced Threat Prevention

PAN-OS logs

Are there signature release for following vulnerabilities?

Cannot update Adobe Creative Cloud

App & Threat Content Comparison Utility

Unlock your full community experience!

Resolved! Best practice stopping attacks from outside