Help With Custom Datafield or Vulnerability

[SDorsey]

I have a Snort rule for a specific network activity I wish to either block or alert on. I would like to translate this into a PAN. Would it be best to do a data field or a vulnerability?

alert tcp any any -> any any (content:"|6E|"; depth: 1; content:"|36 36 36 58 36 36 36|"; offset: 3; depth: 7; msg: "Beacon C2"; sid: 1000000001; rev:0)

[hshah]

Hello Mackwage,

It would be difficult to find exact match for snort policy because in PANW you can specifiy source IP/Port/zone, destination IP/Port/zone and application.

You may have to create custom signature for the application and than call that application in to policy.

Please provide more information on the field of snort, so I can help you with custom signature.

Regards,

Hardik Shah

[SDorsey]

The main goal is to find this traffic pattern and either alert or block. "36 36 36 58 36 36 36" (regardless of application or port). Does that help?

[hshah]

Hello Mackwage,

I got information, give me couple of minutes to find out solution. I think its very much doable with PANW.

Regards,

Hardik Shah

[HULK]

You may refer these DOC:

Custom Application Signatures

Creating Custom Threat Signatures

Thanks

[hshah · Accepted solution]

Hello MAckwage,

It should be easily doable with Object > Security Profile > Data Filtering.

In Data Filtering, you have leverage to specify different kind of patterns.

Please refer following document for data filtering.

https://live.paloaltonetworks.com/search.jspa?q=data+filtering

Let me know if this helps.

Regards,

Hardik Shah