PAN-SA Signatures

Good day,

Seeing as security device targetted attacks a re increasing, I'd like to know if PANW releases the PAN-SA advisories as actual signatures. I can filter and analyse the CVE's disclosed for each PAN-SA, when available, but therse are general

help on Custom signature base on the return traffic

Dear Bros

     Anyone has the experience of create custom signature base on the return traffic? attached please find the PCAP file

     This is JBoss attack while custom want us to alert base on the server return traffic content pattern which means a

Custom Application Signatures

Hi

I have created custom Application id for one of my web application server hosted in Amazon cloud. but its not working. can anyone help against this.  Here with i have attached xml file for your reference.

Signatures (Custom /Default ) Signature

Hi Team,

Need some info on Signature.

My question here is  Can We able to see the Default Signature or the customized Signature  with the read only access. If yes then can any body help me out to know the process. 

Thanks in advance.

Uma.

Import Snort signature and MD5 hash into either custom application/threat signature

I would like to import my existing Snort custom signatures and MD5 hash into the PA FW. Dore it requires any tools? I couldn't find any documentation. 

Thanks 

Custom App-ID for 2016 International Games in Rio de Janeiro

https://live.paloaltonetworks.com/t5/Configuration-Articles/Custom-App-ID-for-2016-International-Games-in-Rio-de-Janeiro/ta-p/101153

Detecting a specific Linux binary(ELF) file using a custom signature

DISCLAIMER:

As with all custom signatures on this forum, this signature is being provided by the author as a result of enthusiasm for the product and to share ideas with the Palo Alto Networks security community.

It is:

- Not recommended for depl

Custom Threat Signature for unique EXE files

DISCLAIMER:

As with all custom signatures on this forum, this signature is being provided by the author as a result of enthusiasm for the product and to share ideas with the Palo Alto Networks security community.

It is:

- Not recommended for deploymen

Cannot Match an business usage application using 4first digit palyload for an unknown-tcp.

Hi Team,

Can you please help me define a custom App-ID using the attached PCAP.

the application is a client-server application that uses dynamic range of TCP port. 

from 30000 to 35000.

Thanks in advance.  

Custom Signature for Email Headers

I am trying  to create a custom signature with the purpose of preventing malicious/phishing/spam emails with the firewall before it hits our mail gateway. For the most part we have been successful with this technique but I am struggling with creating

Signature for Clash of Clans game

I built the attached custom application signature for the Clash of Clans game (previously identified as unknown-tcp) based on taking multiple pcaps and finding the first 7 bytes of the first 4 data packets appear to be constant across sessions. Howev

Example Signature for WPAD.DAT Exploitation (TA16-144A)

One attack avenue for an organization that the US-CERT is currently alerting on is the abuse of Web Proxy Auto-Discovery in order to hijack traffic by directing a web browser to a proxy they own.

The technical details are available at: https://www.