About HITSSEC

Inzamam,   We do certificate based pre-logon authentication with Global protect.  We allow access to fileshares and Lync / Skype for Business in addition to Domain Controllers, DNS servers, SCCM and SCEP servers.  Not all of our users are allowed internal access but all would have internet access.  By allowing access to the infrastructure components during prelogon we have avoided as lot of user headaches.   Hope this helps,   Phil ... View more

Hello,   We use pre-logon and grant access to only domain login required resources.  Once the user logs in with their credentials they get full access.  In the hotel scenario pre-logon can't work so you log into your laptop and authenticate against cached credentials.  Once you have your internet connection GP will pass your credentials and you get your access.  If the user tells their computer to remember the wifi settings then subsequent connections will use pre-logon.     Hope this adds a bit of clarity.   Phil ... View more

bkluth,   As a best practice we put all IP addresses hosting an exploit kit (Angler, Rig or Nuclear)  on a dynamic blocklist we do this upon notification of the IPS log event.  Looking at all traffic going to the site that is hosting the exploit kit sometimes shows other users going there.  The Impact to them is not known as there is sometimes no IPS event, no files coming down and sometimes no other network behaviors.  Our rationale is that there is nothing good at that IP address.   Phil ... View more

Bkim;   I agree with rcole.  If the evasion technique creates an unknown application  then you should already have policies in place to deny unknown udp and tcp traffic. While a signature (if possible ) would work in this situation the more encompasing approach would be to block unknown apps as mentioned. If the traffic causes a url category of "unknown" to be generated then you should deal with that situation within yout URL filtering policy.  Signatures are great for specific or unique traffic patterns when other methods can't address the problem / situation. Glad you thinking out of the box.   Phil ... View more

Rcole,   Here is an expanded version of the NMap signature.  We noticed an additional web requests associated with the NMap tool and have included it in our signature. Below is what we have added as an "or condition" string:   Operator = pattern-match Context = http-req-uri-path Value = /\.git/HEAD   Thanks,   Phil ... View more