Custom Signatures

Welcome to the Palo Alto Networks Custom Signature discussion board!

The purpose of this board is to discuss everything related to custom signature creation in PAN-OS devices. Palo Alto Networks delivers a large quantity of coverage in our weekly content updates; however, we know that our customers are staffed by dedi

...

Import Snort signature and MD5 hash into either custom application/threat signature

I would like to import my existing Snort custom signatures and MD5 hash into the PA FW. Dore it requires any tools? I couldn't find any documentation.

Thanks

Custom App-ID for 2016 International Games in Rio de Janeiro

https://live.paloaltonetworks.com/t5/Configuration-Articles/Custom-App-ID-for-2016-International-Games-in-Rio-de-Janeiro/ta-p/101153

Detecting a specific Linux binary(ELF) file using a custom signature

DISCLAIMER:

As with all custom signatures on this forum, this signature is being provided by the author as a result of enthusiasm for the product and to share ideas with the Palo Alto Networks security community.

It is:

- Not recommended for depl

...

Screen Shot 2016-06-16 at 2.13.38 PM.png

Screen Shot 2016-06-16 at 4.17.41 PM.png

Custom Threat Signature for unique EXE files

DISCLAIMER:

As with all custom signatures on this forum, this signature is being provided by the author as a result of enthusiasm for the product and to share ideas with the Palo Alto Networks security community.

It is:

- Not recommended for deploymen

...

Cannot Match an business usage application using 4first digit palyload for an unknown-tcp.

Hi Team,

Can you please help me define a custom App-ID using the attached PCAP.

the application is a client-server application that uses dynamic range of TCP port.

from 30000 to 35000.

Thanks in advance.

Custom Signature for Email Headers

I am trying to create a custom signature with the purpose of preventing malicious/phishing/spam emails with the firewall before it hits our mail gateway. For the most part we have been successful with this technique but I am struggling with creating

...

Resolved! Singature for Jabber tcp/2748

Hi, I try to create a custom signature for Jabber CTI (http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/port/9_0_1/CUCM_BK_T98E8963_00_tcp-port-usage-guide-90/CUCM_BK_T98E8963_00_tcp-port-usage-guide-90_chapter_01.html) running on port 2748.

...

Resolved! Signature by hostname

Hello guys,

We recently discover that sometimes, ramdonly, host called "Windows7" trays to mount a shared folder from our fileserver/DC. We discover this because our SIEM correlated some events from de DCserver. Sadly this SIEM do not show us the S

...

Resolved! batch input

Hi,

i was wondering if I can input multiple inputs to create custom signature.

For example, one of our clients received a long list of files regarded as threat but not listed in threat vault. Because the list is long they would like a simpler method

...

Resolved! Case insensitive Regex expression

I am creating a regex to capture on the expression "Bank of America". I am having trouble getting case insensitivity to work so that I can capture on "Bank of America, bank of america or any other variation. What is the format of this expression to

...

Resolved! Regex Not matching when ? is in the URL.

I am trying to setup a custom application to match based on URL request which contains:

search=

This is the only consistent 7 byte string in the URL. This works fine unless the request contains a preceeding '?' in the URL.

For example the foll

...

Resolved! RegEx - Pattern for strange string not work

Someone can help me for this pattern?

PATTERN:
+-----------------------------------------------------------------------+
PATTERN in Hex:
2b 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d

...

Need help with creating signature for pop3

I would need some assistance with setting up a custom signature for pop3.

I need to make a signature for the USER command returning "-ERR " currently the Pan vuln signature only triggers on the Pass command in vuln id 31709. I run into a fundament

...

Detecting an SSLv2 Server Response with a Custom Signature

DISCLAIMER:

As with all custom signatures on this forum, this signature is being provided by the author as a result of enthusiasm for the product and to share ideas with the Palo Alto Networks security community.

It is:

- Not recommended for deploy

...

Detect random sub-domain DNS query

Hello,

I would like know if anyone has succesfull creating a custom signature either Custom spyware object or custom vulnerability signature to detect random sub-domain in DNS query.

For example:

We don't want to block www.yahoo.com or yahoo.com do

...