Frustration with threats from PA

[ericgearhart]

Is anyone else frustrated with PA's approach to threats and threat signatures?

Prime example: "Netbios Small Piece Data Evasion Attack Vulnerability" - signature ID 33511, link to the Threat Vault: https://threatvault.paloaltonetworks.com/Home/ThreatDetail/33511

Can we please get some kind of an idea of what the heck this is in reference to? A Microsoft KB? Some kind of hint about figuring out if this is a FP or not? Google searches for "Netbios Small Piece Data Evasion Attack Vulnerability" turn up a link to Microsoft KB that's no longer valid.

[HULK]

The signature 33511 will be triggered if there are two netbios packets which length is less than 4 bytes in one session. Some evasion techniques will use this method to get rid of detection, but this signature itself is not a vulnerability. 

This is just an indicator that PAN find some evasion packet. It not means it is malicious.

Hope this helps.

Thanks

[ericgearhart]

Thanks HULK, that does indeed help