12-03-2015 05:02 PM
Hi everyone, I'm sorry if this has been answered elsewhere-- I'm new to this livecommunity thing so, although I tried to search for an answer before posting-- I may have missed something...
I'm running PanOS 6.1.7 and I can't find anything that explains what gets logged in the 'misc' field of the threat syslogs when the subtype is 'vulnerability'.
These PanOS 6.1 docs (link!) tell me what to expect in the misc field if the subtype is wildfire, virus, url, or file-- but I've got some logs I'm trying to analyze where the subtype is vulnerability and in the misc field there is a filename. I would like to assume that this filename might indicate the file on the attacker machine that is attempting the exploit-- but that seems too good to be true-- so I have to double check.
The particular vulnerability I'm looking at is #34945, the "Apache HTTP Server mod_log_config Null Cookie Denial of Service Vulnerability". In the last week, we've logged ~600,000 instances of this vulnerability. In 97% of those cases, the misc field in our syslogs listed a filename. About 30 times the filename listed was a .jpg; the other ~590,000 times it was the same file-- 'SetupOSX.mpq'-- which is used while installing Blizzard games (I'm not a gamer myself, but man, I support a lot of them).
So it would really help me out to be certain of what those filenames are supposed to indicate. Thank you!
