What is the misc field in the threat syslogs supposed to show when the subtype is vulnerability?

[lawinter]

Hi everyone, I'm sorry if this has been answered elsewhere-- I'm new to this livecommunity thing so, although I tried to search for an answer before posting-- I may have missed something...

I'm running PanOS 6.1.7 and I can't find anything that explains what gets logged in the 'misc' field of the threat syslogs when the subtype is 'vulnerability'. 

These PanOS 6.1 docs (link!) tell me what to expect in the misc field if the subtype is wildfire, virus, url, or file-- but I've got some logs I'm trying to analyze where the subtype is vulnerability and in the misc field there is a filename. I would like to assume that this filename might indicate the file on the attacker machine that is attempting the exploit-- but that seems too good to be true-- so I have to double check.

The particular vulnerability I'm looking at is #34945, the "Apache HTTP Server mod_log_config Null Cookie Denial of Service Vulnerability". In the last week, we've logged ~600,000 instances of this vulnerability. In 97% of those cases, the misc field in our syslogs listed a filename. About 30 times the filename listed was a .jpg; the other ~590,000 times it was the same file-- 'SetupOSX.mpq'-- which is used while installing Blizzard games (I'm not a gamer myself, but man, I support a lot of them). 

So it would really help me out to be certain of what those filenames are supposed to indicate. Thank you!

[reaper]

Hi

There's more information available regarding that threat in the ThreatVault

This appears to be an attack agains an apache server and those files may be what is being detected in the http header the moment the vulnerability is tripped, you could try enabling extended packetcaptures on the vulnerability profile to gain some visibility into the session packets

regards

Tom