Custom Signatures

Welcome to the Palo Alto Networks Custom Signature discussion board!

The purpose of this board is to discuss everything related to custom signature creation in PAN-OS devices. Palo Alto Networks delivers a large quantity of coverage in our weekly content updates; however, we know that our customers are staffed by dedi

...

Signatures (Custom /Default ) Signature

Hi Team,

Need some info on Signature.

My question here is Can We able to see the Default Signature or the customized Signature with the read only access. If yes then can any body help me out to know the process.

Thanks in advance.

Uma.

Import Snort signature and MD5 hash into either custom application/threat signature

I would like to import my existing Snort custom signatures and MD5 hash into the PA FW. Dore it requires any tools? I couldn't find any documentation.

Thanks

Custom App-ID for 2016 International Games in Rio de Janeiro

https://live.paloaltonetworks.com/t5/Configuration-Articles/Custom-App-ID-for-2016-International-Games-in-Rio-de-Janeiro/ta-p/101153

Detecting a specific Linux binary(ELF) file using a custom signature

DISCLAIMER:

As with all custom signatures on this forum, this signature is being provided by the author as a result of enthusiasm for the product and to share ideas with the Palo Alto Networks security community.

It is:

- Not recommended for depl

...

Screen Shot 2016-06-16 at 2.13.38 PM.png

Screen Shot 2016-06-16 at 4.17.41 PM.png

Custom Threat Signature for unique EXE files

DISCLAIMER:

As with all custom signatures on this forum, this signature is being provided by the author as a result of enthusiasm for the product and to share ideas with the Palo Alto Networks security community.

It is:

- Not recommended for deploymen

...

Cannot Match an business usage application using 4first digit palyload for an unknown-tcp.

Hi Team,

Can you please help me define a custom App-ID using the attached PCAP.

the application is a client-server application that uses dynamic range of TCP port.

from 30000 to 35000.

Thanks in advance.

Custom Signature for Email Headers

I am trying to create a custom signature with the purpose of preventing malicious/phishing/spam emails with the firewall before it hits our mail gateway. For the most part we have been successful with this technique but I am struggling with creating

...

Resolved! Singature for Jabber tcp/2748

Hi, I try to create a custom signature for Jabber CTI (http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/port/9_0_1/CUCM_BK_T98E8963_00_tcp-port-usage-guide-90/CUCM_BK_T98E8963_00_tcp-port-usage-guide-90_chapter_01.html) running on port 2748.

...

Resolved! Signature by hostname

Hello guys,

We recently discover that sometimes, ramdonly, host called "Windows7" trays to mount a shared folder from our fileserver/DC. We discover this because our SIEM correlated some events from de DCserver. Sadly this SIEM do not show us the S

...

Resolved! batch input

Hi,

i was wondering if I can input multiple inputs to create custom signature.

For example, one of our clients received a long list of files regarded as threat but not listed in threat vault. Because the list is long they would like a simpler method

...

Resolved! Case insensitive Regex expression

I am creating a regex to capture on the expression "Bank of America". I am having trouble getting case insensitivity to work so that I can capture on "Bank of America, bank of america or any other variation. What is the format of this expression to

...

Resolved! Regex Not matching when ? is in the URL.

I am trying to setup a custom application to match based on URL request which contains:

search=

This is the only consistent 7 byte string in the URL. This works fine unless the request contains a preceeding '?' in the URL.

For example the foll

...

Resolved! RegEx - Pattern for strange string not work

Someone can help me for this pattern?

PATTERN:
+-----------------------------------------------------------------------+
PATTERN in Hex:
2b 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d

...

Need help with creating signature for pop3

I would need some assistance with setting up a custom signature for pop3.

I need to make a signature for the USER command returning "-ERR " currently the Pan vuln signature only triggers on the Pass command in vuln id 31709. I run into a fundament

...

Detecting an SSLv2 Server Response with a Custom Signature

DISCLAIMER:

As with all custom signatures on this forum, this signature is being provided by the author as a result of enthusiasm for the product and to share ideas with the Palo Alto Networks security community.

It is:

- Not recommended for deploy

...