03-27-2023 07:00 AM
I'm looking for a way to define a custom signature that can detect brute force attempts on the GlobalProtect portal that aren't based on the portal login page. I already have ID 40017 - VPN: Palo Alto Networks SSL VPN Authentication Brute Force Attempt - in place and working fine, however I realized that I'm seeing attacks now where someone has managed to replicate the auth sequence from the GP app itself. I've attempted using the following, but am not having any luck with it detecting my failed attempts:
Wireshark shows a 512 HTTP status code is returned when the auth fails:
I'm sure I'm missing something, so please let me know if you spot it or have dealt with this before.
