About HITSSEC

HITSSEC · ‎03-16-2016

Inzamam, We do certificate based pre-logon authentication with Global protect. We allow access to fileshares and Lync / Skype for Business in addition to Domain Controllers, DNS servers, SCCM and SCEP servers. Not all of our users are allowed internal access but all would have internet access. By allowing access to the infrastructure components during prelogon we have avoided as lot of user headaches. Hope this helps, Phil

HITSSEC · ‎02-12-2016

Hello, We use pre-logon and grant access to only domain login required resources. Once the user logs in with their credentials they get full access. In the hotel scenario pre-logon can't work so you log into your laptop and authenticate against cached credentials. Once you have your internet connection GP will pass your credentials and you get your access. If the user tells their computer to remember the wifi settings then subsequent connections will use pre-logon. Hope this adds a bit of clarity. Phil

HITSSEC · ‎12-03-2015

bkluth, As a best practice we put all IP addresses hosting an exploit kit (Angler, Rig or Nuclear) on a dynamic blocklist we do this upon notification of the IPS log event. Looking at all traffic going to the site that is hosting the exploit kit sometimes shows other users going there. The Impact to them is not known as there is sometimes no IPS event, no files coming down and sometimes no other network behaviors. Our rationale is that there is nothing good at that IP address. Phil

HITSSEC · ‎12-01-2015

Bkim; I agree with rcole. If the evasion technique creates an unknown application then you should already have policies in place to deny unknown udp and tcp traffic. While a signature (if possible ) would work in this situation the more encompasing approach would be to block unknown apps as mentioned. If the traffic causes a url category of "unknown" to be generated then you should deal with that situation within yout URL filtering policy. Signatures are great for specific or unique traffic patterns when other methods can't address the problem / situation. Glad you thinking out of the box. Phil

HITSSEC · ‎11-30-2015

Rcole, Here is an expanded version of the NMap signature. We noticed an additional web requests associated with the NMap tool and have included it in our signature. Below is what we have added as an "or condition" string: Operator = pattern-match Context = http-req-uri-path Value = /\.git/HEAD Thanks, Phil

HITSSEC · ‎11-18-2015

If you want the entire class C address space you could have a three patterns: 111\.2\.3\.. covers 0-9 and 111\.2\.3\... covers 10-99 and 111\.2\.3\.... covers 100-255 the trailing period is a wildcard Alternatively you can have a pattern for each IP address.

HITSSEC · ‎11-17-2015

Here is a signature that works: Operator: Pattern-Match Context: http-req-host-header Pattern: 111\.2\.3\.4 Qualifer: http-method Value: GET We have been using it for awhile. We set the action as reset-both. Can always use an exception response of block-IP if you are getting too many of them or if the originator has bad intentions. Hope this helps, Phil

HITSSEC · ‎10-29-2015

Viren, To use custom signatures you need to tirgger on a defined traffic patten based on the contexts you have available for our use when creating a signature. Since you want a honeypot trigger the challenge you would have is what traffic are you going to trigger on? Might I suggest you create a security rule for you honeynet and use a logging profile that can alert you via txt message or email immediately upon being triggered. Thought I would throw that out for your thoughts. regards, Phil

HITSSEC · ‎10-15-2015

The signature can have multiple sets of patterns. Each set of patterns (max 16) can be "or" conditions. The pattern string can be for specific purposes such as misuse of access to PHP related resources. Does this add any clarity or am I missing something. Phil

HITSSEC · ‎10-11-2015

Hello To address the limit of 16 patterns you just need to add another signature as shown below: Each signature can have 16 "or" values. I have signatures that have +50 string patterns Hope this helps. Phil

HITSSEC · ‎09-11-2015

Snake, I don't think there is a majic bullet here but here are some ideas based on what we are doing. Incorporate a high level identifier nmenonic at the start of the name. This might be customer or physical location or a zone. We then try to have a descriptive nmenonic for the server type or application. Such as Exch2010 or mysqldb. We often add the last octets of the IP address to the name. This helps us know what it's IP address is just by looking at the object name. This becomes helpful when you have larger numbers of Objects (eg. +5000). Hope this gives you some ideas. Phil

HITSSEC · ‎09-11-2015

dyoung, While your settings are correct and the AV version should be the same on both appliances occassionally we have seen the file transfer (AV updates) not being successfully pushed across to the peer. Sometimes you may have to force a config synchonization or when you do your next commit it wil be pushed accross to the peer. Hope this helps, Phil

HITSSEC · ‎09-01-2015

This document https://www.sans.org/reading-room/whitepapers/auditing/palo-alto-firewall-security-configuration-benchmark-35777 will help guide you through all the basics to help ensue you are not missing anything obvious. Taking a more agressive response with your IPS responses (default actions of reset and drop) and using an exception response of block-ip will reduce the effectiveness of a scanning tool. Hope this helps, Phil

HITSSEC · ‎07-01-2015

Here are some screen snapshots. By default we have it set to alert but that is your choice. Hope this is helps. Phil

HITSSEC · ‎06-18-2015

Sven, Would using the sinkhole feature within your Anti-spyware Profile help? We have a situation where the user to DNS server communication does not traverse the firewall. By using the sinkhole response on DNS signatures you can see who is going to the sinkhole IP address (because you define it and force the traffic to it to traverse the firewall ). Certainly this is useful in helping you to look a bit more closely at specific source IP addresses on your network. DNS sinkhole is one of those red flags to help you identify unusual or suspicious traffic. Hope this helps, Phil

HITSSEC · ‎06-15-2015

None here in the last week. 1 M incoming url requests per day. Phil

HITSSEC · ‎06-11-2015

True. but having an Antivirus Profile of "none" will not work for testing. That was the main point I was suggesting. The block profile is just what we have in place.

HITSSEC · ‎06-10-2015

Slawek, Your screen print for the sample rule should have an Antivirus profile that blocks traffic. Like below: Profile view: Just saw it was missing in your example and may have been an oversight on your part. Hopefully this helps. Phil

HITSSEC · ‎06-08-2015

Steve, We generally wait for the tester to cry "Uncle" as our IPS has a block IP response action for many of the threat signatures. If they are paying attention, they will notice a lack of responses and get in touch with their contact. If they just run the script then the will have very little to report on. If they are professional they will report on their success with the IPS enabled and also report on the vulnerabilities on the underlying server (without IPS protection). That way you get two useful reports. Phil

HITSSEC · ‎06-08-2015

Rich, Yes if you trust your tester, otherwise limit the rule to the apps and/or ports in the original rule. Phil

HITSSEC · ‎06-08-2015

We started with the standard policies / vulnerability profiles to see how effective the current state is. If your IPS is set to deliver a Block-IP response they the test may be a short one. We then created a rule above the standard rule that handles the traffic to white list the tester with a profile that was alert only. This way you get to see how effective your policies are and the tester gets to test the underlying servers to see how effectively you have them patched and configured. Regards, Phil

HITSSEC · ‎05-19-2015

Just to add a bit of detail to Steve's Answer: System logs under the monitor tab. filter: ( description contains 'Captive Portal authentication succeeded for user: domain\user') Hope this helps. Phil

HITSSEC · ‎05-13-2015

Asntonic We have written signatures for malicious intended web requests and to block the downloading of specific files (adware, toolbars, undesired software). Phil

HITSSEC · ‎05-12-2015

Thanks for the update Santonic as I could see nothing wrong and was about to say "time for the wireshark packet capture to see what the available data looks like". Good luck with your signatures. I have written a lot over the past 2 years and they have proven to be useful. Phil

HITSSEC · ‎05-07-2015

Hello we started seeing Google using the quic application to download Gmail attachments to the client's desktop. This application was not decrypted using a forward proxy and thus did not give us visibility for file attachments being downloaded within GMail. Does create a blind spot and thus pose a risk. Will try blocking it to see the impact is. Phil

HITSSEC · ‎05-06-2015

ajr13, The web site could have been hosting malware (thus being categorized as malware). If the site administrator was informed and then removed the malware and patched their server to prevent further malware being placed on the server. The site then get a re-categorization request and since the malware is not there anymore it gets classified as it normally should be. This is how I expect it works. Hope this helps. Phil

HITSSEC · ‎05-05-2015

jlinkwsky, Since the sinkhole IP address has nothing physically associated with it the action is irrelevant. The important thing is that the malware / spyware infected host is attempting to go to the destination and the traffic attempt is being logged. An action of "allowed" does not introduce any risk as there is normally nothing assigned to the sinkhole IP address. In our case it is a 10.x.x.x IP address that gets routed out to the internet in our case. I hope this explaination adds sone clarity. Phil

HITSSEC · ‎04-25-2015

For those of you who use a vpn client (other than Global Protect) quite often you are delivering DNS services to the vpn client device. If you allow the sinkhole traffic through the vpn connection (set as a default or global rule) then you will be able to identify vpn endpoints with spyware / malware present. Using the IP addresses identified as going to the sinkhole you can go to your VPN console and look at the logs to find the user / endpoint involved.

HITSSEC · ‎04-19-2015

Hello Sly_Cooper, Since most people set up a fictious IP address as their sinkhole IP address, there is no host on the other end. Any tcp traffic would not make it past the initial syn requests. In order to capture some traffic, the destination host would have to be listening on the applicable port and get past the three way handshake. The data folowing that would be what you are looking for. A sinkhole is just a destination for traffic to go to, it's main benefit is identify infected hosts based on seeing the traffic attempts to the destination IP address of the sinkhole. Hope this helps, Phil

HITSSEC · ‎04-15-2015

Hello, We have created a custom vulnerability signature to detect XP devices based on identifying the user agent string as described in Custom vulnerability signature for identifying Windows XP clients . The issue we are encountering is that the signature by default has an action of alert but in the vulnerability profile there is an exception response of reset-client. The issue we encountering is that the signature action is inconsistant. We are seeing threat log entries with the action of alert as opposed to the anticipated action of reset-client. Any ideas what might be causing this behavior? Any ideas or thoughts would be appreciated. Phil

Date Registered	‎02-17-2011 02:48 PM
Date Last Visited	‎01-23-2019 05:58 PM
Total Messages Posted	141
Total Likes Received	52

Online Status	Offline
Date Last Visited	‎01-23-2019 05:58 PM

Strata

Prisma

Cortex

About HITSSEC