Detecting VNC without a password

[tdck63]

Has anybody tried to create a custom siganture, (or has it been discussed as a native signature by Palo Alto), for detecting a VNC session initiated without a password challenge/response? It seems like this would be a useful audit notification to protect against the everpresent layer 8 threat...

[jseals]

Hello,

This is an interesting idea. I haven't heard of anyone attempting it.

We have a forum that is more suitable for this query, I'd suggest that you post it in our DevCenter:

https://live.paloaltonetworks.com/community/devcenter

Also, you can submit this idea to our content team for them to possibly create it in the future by going to the following link:

http://www.paloaltonetworks.com/researchcenter/submit-an-application/

Thanks,

Jason Seals

[tdck63]

Hi Jason,

Thanks for the feedback. I moved the thread to DevCenter, submitted an application request (and I also checked with Palo Alto support via the ticket system). If I find out anything else, I will post it here for reference!

[jseals]

Hi,

That sounds great. Please keep us informed.

Thanks,

Jason

[SRA]

The threat research team is investigating if this can be covered using a vulnerability signature in a future content update.