CVE-2024-3400 Unit42 Threat Brief / Private Data Reset

Unit42 updated the threat brief at Threat Brief: Operation MidnightEclipse, Post-Exploitation Activity Related to CVE-2024-3400 (Updated April 22) (paloaltonetworks.com) on 22 April to include remediation steps for each observed level of exploit atte

Query for CVE-2024-3400

Hello Team,

Work around is for mentioned vul is to install latest Applications and Threats content version

Applications and Threats content version 8833-8684 is already installed in our firewall, could you please confirm is our firewall affected?

How can I see if my FW has already been exploited by the CVE-2024-3400?

Hello team

How can we determine if your device logs match the known indicators of compromise (IoC) for this vulnerability?

I have already fixed the vulnerability and I have the TSF of my device and I want to see if I have been exploited before applyi

Firewalls

Hello, I am a student wondering, is a firewall the best for safeguarding sensitive information and network assets 

Is Pan-OS 10.1.12 susceptible to CVE-2023-51384 or CVE-2023-513845?

Is Pan-OS 10.1.12 susceptible to CVE-2023-51384 or CVE-2023-513845?

Our Tenable scans says it is, but I see no fix recommended for it (for any PAN-OS release).   We have updated our ciphers to remediate CVE-2023-48795 but it also still shows up on

How to choose signature for sql-injection?

Hi all, in palo alto, there are 380+ signatures which are related to sql injection, and the default action for all is set to "alert". Now we want to change the action to reset, can anyone please advise how to choose the signature? it is not possible

FP detection - Virus/Win32.WGeneric.efgjql

Hello,

Following file is matched as malicious by the following signature Virus/Win32.WGeneric.efgjql when trying to download via Palo Alto FW.

Every other security vendor marks the file as benign, see VirusTotal

File is available via https://cdn.devo

Compromised or commonly used username found in HTTP Basic Authentication

Hi, can i get common username patterns that are getting matched with the PA signature "Compromised or commonly used username found in HTTP Basic Authentication" ??

Any links where i can get the usernames that are mapped with this signature which ar

False Positive: virus/win32.wGeneric.efbuyk

Wanted to see if anyone else was receiving false positives from virus/win32.wgeneric.efbuyk threat when utilizing Ivanti EPM for patch delivery/deployment.  

About Virus/Win32.WGeneric.eevxic

The following detections have been occurring for the past few days.
I would like to know information about this threat.
I have run a virus scan on my device and confirmed that there are no problems.
Is it a false positive?
If anyone knows, please let me

Increase in TCP SYN w/Data activity - Feb. 27

I'm seeing a significant increase in TCP SYN activity mainly from APAC region, all of which started around February 27th.  Anyone else seeing the same?

AGCInvokerUtility.exe - PA picking it up as Virus

Hi Everyone,

Our Palo Alto Anti-Virus Profile is picking up AGCInvokerUtility.exe as Virus/Win32.Wgeneric.Eedlvy(624280308). I did a quick search on Threat Vault and found the associated hash: b807502f1a0804543488c5b85a386452d6f9848bf611db01728f3d8