The purpose of this board is to discuss everything related to custom signature creation in PAN-OS devices. Palo Alto Networks delivers a large quantity of coverage in our weekly content updates; however, we know that our customers are staffed by dedi
...
Hi Team,
One of the customer is looking to block files based on data filtering and he wanted to block any text that contains C programs, he wants to block based on the keywords used in the program.
Sample Regex used by customer.
.*(.*(\#include).*((c
...
I built the attached custom application signature for the Clash of Clans game (previously identified as unknown-tcp) based on taking multiple pcaps and finding the first 7 bytes of the first 4 data packets appear to be constant across sessions. Howev
...
Hi all
I have a question about the possibility to create a specific custom signature to block some mail.
I need to block email that contantains:
1- specific email address(it is easy i did it)
2- email with some specific word contained in the email body(f
...
hi
zenmate application is available in PA app but it is not blocking the traffic ,
tried using the URL based but pcap doesnt show any URL
tried to block through client hello SNI but no lcuk ....
please advise how i can block this on PA
app name - zen
...
I am trying to create some data patterns for credit card numbers. I cannot get it to take any of my regex statements. below is one of them the error is saying its invalid. Does anyone have any good solid Credit Card Number and Social Security Number
...
As a SIP provider, looking for to create a custom signature that matches a SUBSCRIBE message from the packet payload w/ 10 or 11 digits. We first tried this w/ Data Patterns under the Custom Objects but that didn't solve/address our issues.
We then cr
...
I am trying to create a custom signature to block macro-enabled word documents. I can't use the "39154" signature for blocking, because it also blocks other office documents, such as .xlsx. I am in the testing phase, and I have created a custom signa
...
We have been slammed with random Chinese IP addresses attemping to brute-force accounts via SMTP. Amusingly enough, our gateway doesn't even support that feature but the amount of traffic attempting it is consuming all available ports.
I was able to
...
Hi Everyone
I have a problem, in monitoring traffic, connection influxdb with port 8086 did not work. traffic status is incomplete.
I was trying setup manually application for influxdb but did not work.
Could you give me a explanation?
please advise how can i block the mentioned vpn on FW
i have blocked all the URLS using URL filtering which was hiting the firewall showing under URL filtering after enabling alert on all catagory
blocked unknown - tcp and unknown - udp traffic
SSL d
...
One attack avenue for an organization that the US-CERT is currently alerting on is the abuse of Web Proxy Auto-Discovery in order to hijack traffic by directing a web browser to a proxy they own.
The technical details are available at: https://www.
...
Hi,
I'm attempting to create an application signature to detect Amazon AWS backups. I captured SSL client hello packets to get the the below hex for the pattern match, but signature is not fireing.
Packet,
Hex value,
/x 3531333438623763302d64643237
...
With the rise in popularity of the new Pokemon GO app, has anyone had the opportunity to build a signature or possibly even gather a pcap of the traffic that could be shared (the site is not allowing signups right now so I am unable to produce my own
...
I am seeing that traffic that goes to an specific vendor/model (Zebra LP 2844-z) of labeling printers is being categorized as APPid unknown-tcp or insufficient data on port 2001 TCP. I would like to know if there is a way to get this added to your AP
...
I am looking for the APP-ID based on the signatures that support NATO STANAG 4609 (Motion Imagery Standards Profile)
nikoolayy1
on:
signature based http-req-message-body
nikoolayy1
on:
Brute Force GlobalProtect Portal via GP app
nikoolayy1
on:
Frebniis Malware Hijacks Microsoft IIS Function to Deploy Backdoor
nikoolayy1
on:
Vulnerabilities
nikoolayy1
on:
SMTP Brute Force - different source IPs
nikoolayy1
on:
Has anyone done a custom APP to block recursive DNS queries?
