Threat & Vulnerability Discussions

Welcome to the Threat and Vulnerability Discussion Board

Welcome to the Threat and Vulnerability Forum

The purpose of this forum is to discuss security vulnerabilities and threats. Palo Alto Networks believes that understanding todays threat landscape is critical to effectively detecting and preventing cyb

...

Resolved! Getting SMB brute force logs

hey, guys hope you are doing well One of my customer getting the logs of SMB: User Password Brute Force Attempt for a particular user as the user is connected to Global VPN to LAN the port 445 getting reset both traffic logs in threat logs all things

...

Resolved! Need an threat id .

I need to block these gamarue & avalanche-andromeda malware family please provide me the Thread-ID for this.

Resolved! Malicious IP addresses and High Risk IP addresses objects are not listed in Panorama

Hello,

I would like to add a policy for External Dynamic List in Panorama as a pre-rule for a particular device group. However, I am not able to see the Malicious IP addresses and High-Risk IP addresses in Panorama.

Kindly suggest.

Thanks

Apache Tomcat WebSocket Denial-of-Service Vulnerability' generated by NGFW

RE: 'Apache Tomcat WebSocket Denial-of-Service Vulnerability' generated by PAN NGFW detected on host foo-wrkXXX involving user foo\User.Name

-- Unique Threat ID: 59026

I am wondering if others are seeing this Alert generated due to what appears to be

...

Zone protection flood thresholds

I get ICMP and UDP flood alert messages from my external zone protection profile all the time. It does not seem to impact production - but not totally sure on that though.

We just have 1 - 5220, no Panarama. Anyone have any advise as to how best to co

...

Malicious signature "Virus/Win32.WGeneric.bjpxbe" detected on Cortex XDR

Hi,

Malicious signature "Virus/Win32.WGeneric.bjpxbe" is detected on Cortex XDR.

When dwelled further, details & screen grab from THREAT VAULT are shared for your perusal

Unique Threat ID: 422569341

SHA256 values are (09fb42aa3d9fcb32e2dab5f9e614a1975e

...

Resolved! DNS Security

Hello,

Is there any way to turn off the following information after commit on 9.0.1 with Anti-Spyware Profile attached to Security Policy?

I can't delete Palo Alto Networks DNS Security option from Anti-Spyware Profile.

Warnings

Warning: No Valid DNS Se

...

Vulnerability CVE 2021-3050

Hey, guys, one of my clients want the POA (Plan of Action) for this vulnerability what should I check in the firewall. I checked the Traffic WAN TO WAN the security Profiles are attached properly but the management IP is pvt i access the firewall by

...

Latest DDOS attack related issue on Palo alto

Hey guys one of my client having a concern about the security patch. he has PA-820 PA and PA-220. The New DDOS attack is there ID is CIAD-2021-0030

https://clicktime.symantec.com/3QdtY9QLh9kb4B5ny33Z2KD7Vc?u=https%3A%2F%2Fwww.cert-in.org.in%2F

Please

...

Resolved! threat generic:5llion.com generic:conti.news

How to block this “unknown“ event to the customer that contains the threat generic:5llion.com (408607164). Because this threat is categorized as DNS Signature, the event had the destination port 53

How to enable signature of Unique threat id

Hello guys hope you doing well I had one question this vulnerability is resolved in the unstable version of PANOS as I see we want to enable the Unique id signature because the affected version is 9.1.4 and 10.0.0 so what should I do to enable this u

...

Is PAN AV and/or Wildfire capable of analysing docker image

Hi,

We have enabled SSL Decryption for almost all the web access of our users.

Our devs are asking us to whitelist hub.docker.com, because it's anoying to put our internal CA in kubernetes.

I get it, but there's multiple example of docker image who wa

...

Enabling signatures in content update version 8317

Checking CVE-2020-2040 it says "Until PAN-OS software is upgraded to a fixed version, enabling signatures in content update version 8317 will block attacks against CVE-2020-2040.", and I'm not sure what does "enabling signatures in content update ver

...

case ID-01857601

Hi,

After executing below cmd we are not able access SSH

> configure
# delete deviceconfig system ssh
# set deviceconfig system ssh ciphers mgmt aes256-ctr
# set deviceconfig system ssh ciphers mgmt aes256-gcm
# set deviceconfig system ssh default-hostk

...

Resolved! Colours Whatsapp Spyware

Hi

I am seeing these alerts GENERIC:COLORS.WHATSAP.TOP(345898629) on a regular basis recently, they start at random times and they persist for around an hour then drop.

Has anybody else seen this ? we have checked the host that is generating the aler

...

Discussions