Moriagent malware

[Jafar_Hussain]

Dear Team,

I don't have much idea about Moriagent malware, i got an instruction i need to create a rule or block this malware

 How to stop MortiAgent Malware using snort rule?

I want to stop the MoriAgent malware by applying /using snort rule.

How to configure this in Palo alto ?

Below are snort rule.

1. The below SNORT rule can be used to detect the MoriAgent Beacon.
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:" MoriAgent Beacon
HTTP Request"; content:"/Index.php?i="; depth:200; content:"&t="; within:64;
content:"HTTP/1.1"; within:64; content:"Content-Type: application/json"; within:32;
content:"Content-Length: 0"; within:90; threshold:type limit,track by_src,count
1,seconds 120; sid:1000001; rev:001;)

Can anyone help me to understand what I need to do, I searched about this but didn't get much information.

[BPry]

@Jafar_Hussain,

Check the Threat Vault at the link below for Morti and there's already two antivirus signatures for MortiAgent and a WildFire signature. If you don't find that suitable defense you'll need to look into creating your own custom threat signature.

Custom Threat Signature

Threat Vault

[Jafar_Hussain]

@BPry 

Thanks for the information.

I was unable to find MortiAgent in the PAN threat vault

It is mandatory to create a custom signature for Mortiagent malware.

I have gone through the documents which you provided. if i will create a customer signature what is the threat id we need to use.

[BPry]

@Jafar_Hussain,

The threat ID you select doesn't matter, as long as it's within the available range. Some people make enough to actually create a format for numbering their custom IDs, others don't follow one and simply increment with each entry.

[Jafar_Hussain]

@BPry 

Thank you for the information, i will check this.