malware using encrypted (SSH) transfer over tcp/443

[jmayne]

Does Palo Alto have a signature to detect the use of ssh on non-standard ports like 443? I did not see anything in the threat database.

Thanks,

Jim

[panos]

I don't see a signature for that.

you can use security rule with application default to allow only it's default port for ssh or using services with that rule for other ports.

[jmayne]

Thanks. I will give that a try. Is it possible to request new signatures and if so how would I do that?

Thanks,

Jim

[panos · Accepted solution]

you need to packet capture the traffic for that.

if you can, it is possible to add custom signature from objects/custom signature tab.

[rgraves]

As panos said, that's a rule not a signature. Going back, you can go to Monitor->Traffic and search for (port eq 443) and (app neq ssl) or perhaps (port neq 22) and (app eq ssh).

While you're in the neighborhood, if you have a loose policy and are creating denies, also consider a rule to deny things like crossloop, gre, hamachi, ipsec, ipv6, teredo, and an application filter that looks for subcategory=proxy.

[jmayne]

Great advise. Thanks!