Moriagent malware

[Jafar_Hussain]

Dear Team,

I don't have much idea about Moriagent malware, i got an instruction i need to create a rule or block this malware

 How to stop MortiAgent Malware using snort rule?

I want to stop the MoriAgent malware by applying /using snort rule.

How to configure this in Palo alto ?

Below are snort rule.

1. The below SNORT rule can be used to detect the MoriAgent Beacon.
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:" MoriAgent Beacon
HTTP Request"; content:"/Index.php?i="; depth:200; content:"&t="; within:64;
content:"HTTP/1.1"; within:64; content:"Content-Type: application/json"; within:32;
content:"Content-Length: 0"; within:90; threshold:type limit,track by_src,count
1,seconds 120; sid:1000001; rev:001;)

Can anyone help me to understand what I need to do, I searched about this but didn't get much information.

[OtakarKlier]

Hello,

Make sure your PAN objects are setup for AntiVirus, AntiSpyware, URL Filtering, WildFire, and DNS Sink hole. Then make sure they are applied to all inbound/outbound policies so the traffic is inspected. Also make sure your PAN has the latest Dynamic signatures.

Having the PAN setup for this is a great way to dynamically block malicious traffic. Along with your other products, i.e. desktop antivirus, etc.

Regards,

[Jafar_Hussain]

@OtakarKlier 

Thank you for your reply. i have found two signature of mortiagent malware below is the snap:-

Apart from this. it is a mandatory to create a custom signature?

[OtakarKlier]

Hello,

If you have all the other security features turned on and dynamic updates working and up to date. I would say you are good, however check the endpoint AV and make sure its working and maybe even run a full scan.

Regards,

[Jafar_Hussain]

@OtakarKlier 

Thank you for the valuable information.

[Jafar_Hussain]

@OtakarKlier @BPry 

I got the instruction from the gov. i need to create a custom signature for Mortiagent. They have sent some files.

In the files, there is some IOC's:-

1 - Host base indicator( Which is mentioned some MD5 and SHA values)

2 - Network base indicator( Which is mentioned in some IP address list).

To create a custom signature which pattern and references i need to choose ? below is the snort rule:-

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:" MoriAgent Beacon HTTP Request"; content:"/Index.php?i="; depth:200; content:"&t="; within:64; content:"HTTP/1.1"; within:64; content:"Content-Type: application/json"; within:32; content:"Content-Length: 0"; within:90; threshold:type limit,track by_src,count

1,seconds 120; sid:1000001; rev:001;)

- For the IP address, i need to create an EDL to block all the IP's?

Thank you in advance.