Tracking an infected computer

[ToddJohnsen]

I got a notice from my ISP that we have a Conficker infected system (downadup) but I am coming up with nothing when I try to find it.  The less than helpful info I recieve is the first octet of the target IP (38) and source port 61494, which map to hundreds of system.  I also have a destination port of 80, again very helpful.  The firewall is NATing for about 2000 systems.  Has anyone used their panos box to track a system before and if so what did you do?  We have ESET deployed for anti-virus and it is not showing anything right now.  We could be missing a system though.  I am still fairly new to my PA-3020 box so use small words please.

I have been using the threat log and tried the pre-built reports.  The Monitor Logs are amazing but I can't seem to narrow the search enough to find the problem.  I only have the URL filter and threat prevention license on 5.0.9

Thanks,

Todd

[HULK]

Hello Todd,

Is there any related information pops up under Monitor > Threat logs...?

Also please apply below mentioned command to stop suppressing repetitive logs on PAN FW.

# set deviceconfig setting logging log-suppression no

Thanks

[_slv_ · Accepted solution]

Hello Todd

The simplest way is to make a filter in Thread log

I'm not sure that every variant of Conficker has 12544 id, so You can remove "and ( threatid eq 12544 )"

Of course You mast have Thret prevention profile added to security rule that is allowing traffic from You networks to Internet.

Regards

SLawek

[ToddJohnsen]

Thanks SLawek,

I finally figured it out with your help.  I ran the Threats report and found all the Suspicious DNS Query results I had been unable to find before.  Each one has a different ID code that I was able to search for in the Threat log as you describe with great success.  Looks like I should be able to trace this after all.

-Todd