Custom Signatures
The Custom Signatures discussion is a resource for security professionals to discuss the creation process of custom signatures in their PAN-OS appliance.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Custom Signatures
The Custom Signatures discussion is a resource for security professionals to discuss the creation process of custom signatures in their PAN-OS appliance.
About Custom Signatures

Welcome to the Custom Signatures discussion forum. This forum exists as a resource for security professionals to discuss the creation process of custom signatures in their PAN-OS appliance. Please feel free to engage with other community members and Palo Alto Networks staff. Ideas, questions, research, and observations regarding the process of custom signature creation are all actively encouraged.

For an introduction to the forum, please see the sticky!

Disclaimer:
This forum is provided for Live Community members to discuss and share information pertaining to custom signatures. Please use the information from this forum at your own risk and make sure to test and verify any signature and code presented here. For information on contacting Palo Alto Networks support, click here.

Discussions

Welcome to the Custom Signatures Discussions!

To make this forum valuable and enjoyable for everyone, please review the following guidelines before participating:

 

Rules and Best Practices

 

  1. Be Respectful: Treat fellow community members with professionalism and courtesy. Constructive discussion
...

JayGolf by Community Team Member
  • 1274 Views
  • 0 replies
  • 0 Likes

Custom Data Patterns

I am trying to create some data patterns for credit card numbers. I cannot get it to take any of my regex statements. below is one of them the error is saying its invalid. Does anyone have any good solid Credit Card Number and Social Security Number

...

Custom App for SIP

As a SIP provider, looking for to create a custom signature that matches a SUBSCRIBE message from the packet payload w/ 10 or 11 digits. We first tried this w/ Data Patterns under the Custom Objects but that didn't solve/address our issues.

We then cr

...

markibr by L0 Member
  • 3543 Views
  • 2 replies
  • 0 Likes

Resolved! Block Macro-enabled Word documents

I am trying to create a custom signature to block macro-enabled word documents. I can't use the "39154" signature for blocking, because it also blocks other office documents, such as .xlsx. I am in the testing phase, and I have created a custom signa

...

cstarks2 by L1 Bithead
  • 7700 Views
  • 4 replies
  • 0 Likes

SMTP Signature Help

We have been slammed with random Chinese IP addresses attemping to brute-force accounts via SMTP.  Amusingly enough, our gateway doesn't even support that feature but the amount of traffic attempting it is consuming all available ports.

 

I was able to

...

InfluxDB Application Traffic

Hi Everyone

 

I have a problem, in monitoring traffic, connection influxdb with port 8086 did not work. traffic status is incomplete.

I was trying setup manually application for influxdb but did not work.

 

 

 

 

Could you give me a explanation?

1.png

Block Turbo VPN 1.8.1

please advise how can i block the mentioned vpn on FW 

i have blocked all the URLS using URL filtering which was hiting the firewall showing under URL filtering after enabling alert on all catagory 

blocked unknown - tcp and unknown - udp traffic 

SSL d

...

Rameshwar by L3 Networker
  • 2724 Views
  • 0 replies
  • 0 Likes

Resolved! Custom Signature Help

Hi, 

 

I'm attempting to create an application signature to detect Amazon AWS backups. I captured SSL client hello packets to get the the below hex for the pattern match, but signature is not fireing. 

 

Packet,

 

 

Hex value,

/x 3531333438623763302d64643237

...

Amazon_TLS.PNG
Amazon_sig.PNG
phi1771 by L1 Bithead
  • 4173 Views
  • 2 replies
  • 0 Likes

Resolved! Pokemon GO

With the rise in popularity of the new Pokemon GO app, has anyone had the opportunity to build a signature or possibly even gather a pcap of the traffic that could be shared (the site is not allowing signups right now so I am unable to produce my own

...

aelmore by L0 Member
  • 7183 Views
  • 4 replies
  • 0 Likes

Regex for syslog User-ID not working

Hi team,

 

We have the (Cisco & Ruckus) Wireless controllers forwarding SYSLOGS to the User-ID agent running on Windows 2012 server.

 

We want to use these syslog messages to create user-ip mappings. We tried with several different regex patterns but not

...

ansharma by L4 Transporter
  • 3827 Views
  • 2 replies
  • 0 Likes

Custom data pattern

Hi Team 

 

I have a user who has a requirement to add a custom Data Pattern to identify a specific string 

 

Example: 1234/09/4578 

 

(Note the second identifier is a numeric value between [1-9])

 

I set up the data pattern under " Custom Objects --->Data Pa

...

agawade by L2 Linker
  • 3379 Views
  • 2 replies
  • 0 Likes

Resolved! Submitting DNS block without blocking the IP

I'm looking to submit a FQDN block where I don't ever block the IP.

 

I've reviewed this article on blocking FQDN's but can't seem to figure out how to ignore the IP. We assign fake ip addresses to known malicius sites, and need the HTTP, HTTPS, SSH, e

...

Wordpress wp-login.php flood

Today we built a custom vulnerability signature to block excessive request from one IP to wp-login.php. 

 

 wp-login.php thread-id 42106wp-login.php thread-id 42106wp-login.php thread-id 42106wp-login.php flood threat-id 42107wp-login.php flood threat-

...

42106-1.PNG
42106-2.PNG
42106-3.PNG
wp1.PNG
PortsIT by L0 Member
  • 5585 Views
  • 0 replies
  • 2 Likes

Signature for HULK attack?

Hi Everyone,

 

We are in the process of migrating from Cisco ASA firewalls on our Edge to PA 5020. Recently one of our websites was hit with a DDoS attack. After analysis, we determined that it was the HULK attack. 

 

I got my hands on the HULK python sc

...

  • 174 Posts
  • 84 Subscriptions
Labels