09-04-2024 04:37 AM
Hello,
I am seeing a weird activity from globalprotect agents where the agent is trying to execute wa3_3rd_party_host.32.exe
and the agent after that is executing whoami command.
PS: the HIP policy is disabled on the firewall
09-10-2024 05:42 PM - edited 09-10-2024 05:44 PM
Hi @BARaha ,
wa3_3rd_party_host.32.exe is definitely not a standard or commonly recognized executable associated with GlobalProtect. I would recommend to take a look at the host and determine what the .exe is used for and run a scan. In the mean time, monitor the connections made on that particular host through the monitor traffic as well.
Btw, which panos version are you running on your firewall ?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
