03-17-2025 08:32 PM
I was looking for information on finding and removing rootkits on Palo Alto, using the CLI commands. Reinstalling PANos isn't an option for me, but any help would be greatly appreciated. I know there is a rootkit installed, but I am not entirely sure what it does, beyond bricking the firewall when upgraded to a new base version.
03-18-2025 10:51 PM
Hello @CarbonAlligator ,
If you want to know what the rootkit does, you can engage Unit42 or any other vendor to assist in performing the forensics / analysis.
Regarding the device itself, from a security perspective, you SHOULD consider to factory reset the device.
(you get bitten by the snake, you don't wait to know if the snake was venomous or not, you rush to hospital or try to remove if possible the venom)
Olivier
PCSNE - CISSP
Best Effort contributor
Check out our PANCast Channel
Disclaimer : All messages are my personal ones and do not represent my company's view in any way.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
