Welcome to the Threat and Vulnerability Forum
The purpose of this forum is to discuss security vulnerabilities and threats. Palo Alto Networks believes that understanding todays threat landscape is critical to effectively detecting and preventing cyb
...
We have been seeing SMB: User Password Brute Force Attempt threats coming into our logs. We are not seeing a UN accompanied with the the traffic and the are using port 445. This just popped up recently and we are not seeing anything malicious on th
...
hello,
we have an issue in minemeld service disabling access to the web server giving 403 error.
The details is in screeshots.
Any help please ?
Hello there,
We have a constant brute force attempt on port 25 of our email server. We put the vulnerability profile to block these attacks and consequently block the ip for 3600 seconds, however in some cases this ip will try again immediately after
...
Hi Team
How to block below hash value. Please help us
4ad20bcd0f915acba7817e0639fcbf4f713beb8ac35112134808d4e5f753d519
86800f9e3b563eaeba1d84d431b83405b2118300c0ad2deab39a093d4b9093c5
96a64cccb55f7b42711015054ddd6ac45459643aa17c13248c6e344dc787cbfd
aad97
hi Team.
Our production application triggered the "HTTP SQL Injection Attempt" threat alert, mainly ID: 33338 and ID: 36056 and ID: 36239 and ID: 54608; affecting the production business; an exception has been made, how can we determine which SQL stat
hi all, I'm trying to add a regex data pattern for the word Orion. It works everywhere, but Palo Alto just refuses to except it and gives no reason. This is standard regex syntax
([oO][rR][iI][oO][nN])
I need the word "orion" in every possible combi
...
I set medium to drop in the vulnerability protection profile,
but when I check the log, Severity is medium, but action is alert. Why not drop?
If you check the verbose log, the type is url and action is alert. Severity is informational.
In this case,...
Hello everyone,
I am a newbie here. Perhaps anyone here can tell me how to set my PA-28 firewall to block unauthenticated inbounds connections by default. Thanks
Hi,
Is there a way to know what a specific threat ID checks for? We enabled SSL inspection for SMTP traffic and Palo started to flag every e-mail with threat ID 56951 (non-RFC compliant SMTP traffic), but ThreatDB does not provide anything useful
...
Hi everyone,
We are using PAN OS 9.1.5.
Our internal hosts and DNS server are in different PA Zones.
We have a policy to allow all hosts to access DNS servers with application "dns".
We used strict anti spyware profile on the above mentioned security pol
...
A new research has demonstrated a technique that allow an attacker to bypass firewall protection and remotely access any TCP/UDP service on victim machine.
https://thehackernews.com/2020/11/new-natfirewall-bypass-attack-lets.html
Hi Team,
We have received some list of Malicious HASH files and asked us to take the necessary action. But while checking we didn't see the below listed Hash is not covered in Threat Vault.
I want to know why the below mentioned Hash value is not det
...
I am noticing that when either trying to download the latest VideoLAN player from their site, or updating via their application, the PAN is detecting the EXE as Virus/Win32.WGeneric.ashtnf. Is anyone else seeing this behavior?
Thanks
Hello,
On our PA-5220 we hade 3 instances when our Packet Buffer Protection has been crippled by traffic from an SCCM server to a host.
Protocol TFTP UDP, when VM's gone threw PXE boot and on file transfers from SCCM.
Symptoms are that latency goes upp
Hi All,
After upgrade to 9.1.5, i noticed the Severity level high and medium threat actions are allowed and some of them are getting sinkhole. Please let us know if anyone knows why it's getting alert instead of the block in high severity. Attached sc
...
OtakarKlier
on:
Denial of Service Investigating
