Maze Ransomeware Coverage

[SahulH]

Hi Team,

Please let us know the coverage against for Ransomware-Maze under threat in our Palo Alto IPS.

Best Regards,

Sahul Hameed

[BPry]

@SahulH,

There's a number of signatures that are specific to Maze. There's 18 Antivirus signatures, 14 DNS signatures, and 3 WildFire signatures that are specific to the Maze ransomware. That doesn't count all of the more generic droppers that would be caught under non-specific signatures. 

The bigger question I always have when a customer brings this up is if they actually have full visability into the traffic? Are you actively decrypting all traffic, are you enforcing file blocking, have you verified that all of your external traffic is actually configured with a security profile that inspects the traffic? 

Your firewall can only do so much to prevent malicious files from making it to your client machines. So I would ensure that you have something with proper ransomware protections such as Cortex XDR (formally Traps) so that if anything does make it to an endpoint (or an endpoint downloads a malicious file while not behind your firewall) that threat is identified and stopped. 

[SahulH]

@BPryHi BPry,

Thanks for your response and we do have the decryption policy and also configured the Security profile on the outbound traffics.

Is it possible for you to share me with the Application, DNS, Wildfire Signature ID for my reference which you have mentioned below.

Awaiting for your response.

Best Regards,

Sahul Hameed

[SahulH]

Hi @BPry 

Awaiting for your update. Please find the additional details below and help us with the Signature Details.

We have deployed PA firewall into L2 mode with “Threat prevention” feature.
Requesting you to kindly mentioned the AV signature set version and signature details.

I hope these are the signatures are already kept in blocking mode, ne need to do manually block on PA ?

Best Regards,

Sahul Hameed

[Timfw123]

@BPry 

Could you provide more details for these signature (There's 18 Antivirus signatures, 14 DNS signatures, and 3 WildFire signatures that are specific to the Maze ransomware. ) so that we can block it on PA firewalls?

[SahulH]

@Timfw123 

In order to get the Signature details. Please visit to Palo Alto Threat website (https://threatvault.paloaltonetworks.com/) and then search for Maze

Please refer to below snap for your reference. I do find the same from here.

Hope this information will helps you as well.

Note: In order to block those vulnerability Signature you need to map the Security Profiles on all the Security rules which are allowing the traffics.

Best Regards,

Sahul Hameed

[OtakarKlier]

HEllo,

In regards to your question:

"We have deployed PA firewall into L2 mode with “Threat prevention” feature.
Requesting you to kindly mentioned the AV signature set version and signature details.

I hope these are the signatures are already kept in blocking mode, ne need to do manually block on PA ?"

That depends on your policies. If you policies are setup to detect/block, then you should be good provided you have the proper licenses and are performing dynamic updates making sure your PAN has the most up to date signatures.

Regards,

[PriyaNath]

hi palo alto team can we get sent  wildfire report  maze ransomeware