Custom Signatures

Brute Force GlobalProtect Portal via GP app

I'm looking for a way to define a custom signature that can detect brute force attempts on the GlobalProtect portal that aren't based on the portal login page. I already have ID 40017 - VPN: Palo Alto Networks SSL VPN Authentication Brute Force Attem

Can custom appIDs, without signatures, be applied directly to a security policy?

For this discussion, we created custom appID `myApp`, it has NO signature.

If `myApp` uses port 22, the port of another known app (SSH), then to use `myApp`, it must be applied to an App Override policy.

But what if `myApp` uses unique port 2121,

We updated the dynamic antivirus database and threats, but it failed

I've been waiting for 3 days to get help !

My introduction is Mr. Dwi

From PT. Tabsolutions

Indonesia

This is my device

Device Name                      : PA-3020-PLN

Software Version              : 9.1.16

Globalprotect Agent        : 5.2.12

creation of custom app id

Hello everybody, i need to create custom app id in firewall for only gives access to get method while api call, but when i wrote signature i can not define the contex of the method in http request.Any help?

CVE-2023-38802 Dynamic Update Signature

Hi Palo Alto Networks Team, 

I would like to request to add CVE-2023-38802 vulnerability signature to dynamic update. 

I have a few of client having concern about this signature.

Regarding for reason and detect contents.

What communications does this rule detect?

I want to confirm is correct an answer by user.

Answer by user: In order to split the CSV, I created and executed "extract.bat".

Detection Rule:

・Behavioral threat detected (rule: powershell_cradles.b)

s

Customizing Response pages

Need help in identifying a document with all the variables listed to customize response page. This customization is to inform users, the reason why the URL is blocked

Looking for help with a custom vulnerability signature to detect usage of the RC4 cipher set

I am struggling with getting a custom vulnerability signature to detect RC4 server responses.  We have created other custom signatures that are working just fine within the same test policy.  For example, checking for TLS 1.0, 1.1 etc.... I have trie

Issues Creating Custom App

In order to allow Updates to OneDrive im trying to create a custom application. (since I'm blocking PE) as it is detected as web-browsing. It does not detect that ms one drive premade application. 

I created a custom signature with the Client hello

signature based http-req-message-body

HI all,

I'm trying to create a custom signature based on the POST payload the client is sending.

This is the POST collected from the server:

.

.

Frebniis Malware Hijacks Microsoft IIS Function to Deploy Backdoor

https://www.securityweek.com/frebniis-malware-hijacks-microsoft-iis-function-to-deploy-backdoor/

Any signatures available?

Advice on blocking the 'EXTENSION PACKS for Oracle Virtual Box

Oracle's Virtual Box is free and available to use under the GPL v2 license terms.

They have Extension Pack which is not free and can invoke a software audit if found. 

We are looking to see if anyone has an application snippet to prevent download of

Block Platform by Country of Ownership

Hello everyone. I work at a public community college. Our state legislature has proposed legislation that would require us to block any video platform if the platform is owned by a company headquartered outside of the United States. I currently have