Resolved! Virus/Win32.WGeneric.akzslp - ffmpeg.dll

Hi,

Since 2020-07-20 I have been getting Virus alerts in the Threat log on my PAN. It has pointed out that ffmpeg.dll is the culprit.

I pivoted a search by <<Virus/Win32.WGeneric[.]akzslp>> on THREAT VAULT: I found the hash "ea3e32a18d5d2c3dfcf9ff8238

Resolved! Exception for DNS signature which is showing the ID as 0 and FQDN as unknow

Getting false positive for the Link tivoli.com.qa as threat name(68360795).Its getting DNS sinkholing.Can anyone help to know how we  give the exception only for the threat ID 68360795 and the Fqdn is tivoli.com.qa. Attached screenshots below

Resolved! Ripple20 Vulnerability Group

Hi there

About 14 days ago a group of new 19 vulnerabilities were published under the name of "ripple20" by JSOF (https://www.jsof-tech.com/ripple20/). So far I could not find any information about in the community (which I find very strange... Maybe

Resolved! Digium Asterisk WebSocket Frame Empty Payload Denial-of-Service Vulnerabi

How do I report or provide feedback regarding the Cortex Alert named "Digium Asterisk WebSocket Frame Empty Payload Denial-of-Service Vulnerability" that are being generated by the PAN NGFW, with the Initiator CMD of:

"C:\Program Files\WindowsApps\Mic

Resolved! Virus/Win32.WGeneric.ajdriy - OneDriveSetup.exe

Hi,

Since yesterday April 13/2020 I have been getting Virus alerts in the Threat log on my PAN 3020. It has pointed out that OneDriveSetup.exe is the culprit.

I went to a few machines and searched for OneDriveSetup.exe and uploaded it to VirusTotal.

Resolved! Virus/Win32.WGeneric.aktpum - OneDriveSetup.exe detected via an Antivirus

Hello, 
Are seeing the following in Cortex XDR 
'Threat ID #348815361' generated by PAN NGFW detected on host 10.x.x.x involving user ZZZZ\first.last

Threat ID: 2418537

Current Release: 3394 (2020-06-28 UTC)

First Release: 3394 (2020-06-28 UTC)

SHA256:  

Resolved! URL Filtering

http://shodan.io/ URL is categorized as hacking website.

Can someone advise as internal users want access to it?

Resolved! We have enabled ssl inbound decryption and able to exploit the vulnerabilty

We have ssl inbound  decryption configured  and from outside we are able to exploit the vulnerabilty.

Need to know why PA allows the connection for that signature.

Vul  threat id is 57230

Name Telerik Web UI