Suspicious User-Agent Strings

[Jerome.j]

Hi All,

I have noticed a log from our Palo Alto vulnerability report that looks suspicious yet I am unaware of it.

There is a threat "Suspicious User-Agent Strings" detected under the "spyware" category and "HTTP-proxy" application from Globalprotect VPN user IP to our LAN "squid proxy server". 

Please help me understand this traffic and if is there any action that needs to be taken on this.

Thanks,

Jerome

[JayGolf]

Hi @Jerome.j ,

If you can, I would recommend running a pcap on the suspicious traffic from the GP user connecting to your LAN and entering the threat ID into the Threat Vault. Follow up with the source user and investigate what the intent of this traffic is. It's possible that a user can be making suspicious web requests to your proxy or it can be a false positive. I'd also make sure to continue to monitor for related events. The only way to really tell is by diving into what the capture provides. 

Good luck!