Detect random sub-domain DNS query

Hello,

I would like know if anyone has succesfull creating a custom signature either Custom spyware object or custom vulnerability signature to detect random sub-domain in DNS query.

For example:

We don't want to block www.yahoo.com or yahoo.com do

Limiting File Size Upload using Custom Signature

Users in enterprise often use web based file hosting to upload big files. This creates concerns in the usage of networks bandwidth and server storage capacity, as the file can be bigger than 1GB. Below steps are usefull to control file size uploaded

custom mail app-id

hi. 

I'am trying to create a custom mail app-id filter, for matching; to whom mail is gonging to and from what domain.

I have add smtp as a parent application in the app-id.

My app-id is matching the helo, mail from, rcp, data. from the mail. The

Submit a New Threat

Hello,

My IDS has detected a new Angler signature on my network and it was allowed by my PA firewall. The traffic was allowed being the IDS is not inline. How do I submit packets for a threat update/addition?

How to make custom signature with segment field?

Recently, URL filter evasion application often use tcp segment field.

How to make custom application with tcp segment field?

Protocol sequence.

1. SYN 

2. SYN,ACK

3. ACK

4. PSH,ACK : TCP segment data has GET / HTTP/1.1

It can bypass our URL

PAN-OS 7.0.3 bug with Cloning of Profiles

Ran into an issue here tonight where when you clone a profile for anti spyware and pattern match based on that, this is broken and will not alert. Be sure to create a new profile from scratch. I have submitted this to Palo for them to vet this issue...

h323-message-body values

We seem to have a new h.225/h.323 scanning campaign going on that disturbs meetings. The strings that seem to be the same throughout are "productId: MERA RTU" and "versionId: 4.4.0-06a".

So I've tried two different methods of catching this traffic.

Dell Root Certificate "eDellRoot"

Good afternoon, all!

Researchers have discovered a trusted root certificate being deployed by Dell on some newer laptops. For reference, see here.

While an official signature from Palo Alto Networks is likely not forthcoming due to legitimate usa

Example to Detect Malicious ELF Binaries (Linux Encoder Ransomware)

Good afternoon!

We've got another sample of what can be accomplished using our custom signature engine today. Please note before continuing that:

A) This signature exists as a sample to show what is possible, and has not been properly QA'd/soak tested

Example to detect SMTP 550 (destination email address does not exist)

Here is an example to alert when a server responds with SMTP 550 (mailbox does not exist). The context used is 'smtp-rsp-content' and the pattern to be matched is '550\ 5\.1\.1'.
<pattern>550\ 5\.1\.1</pattern>
<context>smtp-rsp-content</context>

Ful

Honey pot signature

Hi,

    I have certain subnets that are currently not in use in our domain, I wanted to ip-block for 30 minutes all ips that access any of these subnets. Is it possible to creat a threat signature for this?

Thanks,

             VIREN