Suspicious User-Agent Strings

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Suspicious User-Agent Strings

L1 Bithead

Hi All,

 

I have noticed a log from our Palo Alto vulnerability report that looks suspicious yet I am unaware of it.

There is a threat "Suspicious User-Agent Strings" detected under the "spyware" category and "HTTP-proxy" application from Globalprotect VPN user IP to our LAN "squid proxy server". 

Please help me understand this traffic and if is there any action that needs to be taken on this.

 

Thanks,

Jerome

1 REPLY 1

Community Team Member

Hi @Jerome.j ,

 

If you can, I would recommend running a pcap on the suspicious traffic from the GP user connecting to your LAN and entering the threat ID into the Threat Vault. Follow up with the source user and investigate what the intent of this traffic is. It's possible that a user can be making suspicious web requests to your proxy or it can be a false positive. I'd also make sure to continue to monitor for related events. The only way to really tell is by diving into what the capture provides. 

 

Good luck!

LIVEcommunity team member
Stay Secure,
Jay
Don't forget to Like items if a post is helpful to you!

Please help out other users and “Accept as Solution” if a post helps solve your problem !

Read more about how and why to accept solutions.
  • 2719 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!