Uptick in RFC2397 Data URL Scheme Usage Detected (30419) ?

[MCmgt]

Before I go on a wild goose chase, has anyone seen an increase in threat 30419 (RFC2397 Data URL Scheme Usage Detected)?

It seems like these things trip for a while until PA figures out someone's using something novel in a new App. A new application sig comes out and the alerts go away...

[ulti]

thank goodness - its not just me. yes, we've seen a huge increase in these and wasn't sure if we should negate these in the policy or if Palo's threat team jacked with the settings in a recent db update. (known to happen)

[ulti]

anyone have thoughts on this? seems noisy for us. Can't tell if Palo changed it in threat db or if there's just a huge increase of it on net.

[MCmgt]

I opened a case (00389881) yesterday. They've heard rumblings from customers but hadn't received any pcaps yet.

By chance, I stumbled across someone tripping the sig and called them. They got red-faced when I asked them what they had just done...visited okmagazine.com. Sure enough, I was able to reproduce it and support has a pcap to look at.

[ulti]

let us know what the outcome is, we're getting these daily whereas we've never had them prior to about a month or so ago

[MCmgt · Accepted solution]

This particular instance was a TTF (TrueType Font) file, and that the purpose of the javascript containing it looked to be css/style/ad delivery using JWPLAYER.

Advertising...

YMMV.

[ulti]

Did you mark it as exception and allow or are you still alerting on it?

[jambulo]

We've been getting a lot of hits on this Threat ID as well.  I think if anything, this ID should be set to Informational or Low.