Malicious .zip file detected as "HackTool/Win32.mimikatz" by AV policy and action shows as 'reset-both' but the file was not blocked

Hello,

While doing testing around our security controls, we did intentionally try to download Mimikatz onto an isolated workstation to see if Palo Alto blocks the download, however though Palo did alert with multiple threat names starting with "Hac

Network

Hi Team,

We have a customer he is facing issue with, Sliver Framework Command and Control Traffic Detection - ThreatID 86680.

He is getting below sync error,

URL : mail.google.com/sync/u/0/i/s?hl=en&c=649&rt=r&pt=ji 

I have gone through the below art

Sliver Framework Command and Control Traffic Detection - ThreatID 86680

Hi all,

has anyone see this critical threat which is correlated in our environment with google mail?

This event started with content-8770-8365.

I can see that PaloAlto did some changes in Modified Anti-Spyware Signatures in release notes.

It simp

Paloalto case number 02759964

I want to align an engineer for the case raised mentioned in the subject. Please help in doing so asap

Which is best PA IPS or Azure IDPS

Which is best PA threat protection or Azure IDPS

Vulnerability Assessment-CVE-2022-0778

Hi,

We have CVE-2022-0778 affected for couple of our boxes and we are in midst of patching as well.

Apparently, we don’t have SSL inspection enabled on any of our boxes. Hence would like to confirm if there is any impact to us.

Need to confirm whet

wildfire-virus threatID 602574714 false positive ?

Good Morning,

Has anyone had WildFire-Virus threat events with the following  threat ID:602574714 ?

Antivirus Signatures 

Threat 86751 - PotatoVPN Detection

I am getting hits on this threat, categorized as Spyware, but as far as I can see it is a legitimate client VPN  product.  Why is this being classed as malicious or is it mis-classified?

Threat ID 86798 - BruteRatel C4 Command and Control Traffic Detection

Hi all,

since yesterday I see this threat as a critical. I suppouse that is false posotive action.

Didn't find any suspicious actions on the computer and just want to know is there any of you that have observed similar alerts?

Maybe I have to dig

Denial of Service Investigating

If I wanted to to troubleshoot / investigate for a potential DoS attack, what are some logs to look for using the Palo Alto?

Cortex XDR Remote account enumeration

Hello,

today we have interesting alert

At least 33 distinct non-existing accounts failed to remotely log in to XX-Laptop1. Users list: name.user, user name, user.name, username

User has no idea - all day at school, behind NAT. What I cannot reall