Current GlobalProtect scanning campaign

[jstrubberg]

We've been tracking the scanning campaign that made the news recently concerning scanning and dictionary attacks against GlobalProtect portals.  We've been able to put together a parser to pull and deduplicate IP addresses from our logs for those attempts.  Anyone doing something similar? 
Palo Alto, would there be interest in ingesting these somehow to create a block list of some kind?  I'm sure it's the same actors across multiple customers. 

[TomYoung]

Hi @jstrubberg ,

Here is a detailed discussion of the issue -> https://live.paloaltonetworks.com/t5/globalprotect-discussions/use-auto-tagging-to-block-failed-glob....

Here is another post that uses automation to update an EDL -> https://live.paloaltonetworks.com/t5/general-topics/automatically-blocking-ip-s-after-a-certain-numb....

Thanks,

Tom

[jstrubberg]

Thanks Tom.  The tagging option seems like it could land you in a false positive situation if you aren't very careful with the timing of the tag. As for the brute force blocking, in my situation I don't think it would trigger.  Today for instance, I've logged about 1100 attempts from 614 distinct IP addresses. 

What I do have is a very distinct error message in the system log that never happens to a registered user.  I'm using that to parse out bad actor IPs.  My next step is to feed that list back to the logs and see if they ever hit anything other than my GlobalProtect portal to confirm it's nothing but bad actor traffic, and then I will build an EDL with them. 

Was just wondering if there might be a large movement afoot after seeing this week's new article come out about the subject.