This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About RobertoPastorino
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About RobertoPastorino
05-16-2023
16Posts
15Likes
0Solutions
May 16, 2023Last Visited
User
Activity
User
Profile
Latest posts by RobertoPastorino
| Subject | Views | Posted |
|---|---|---|
| 1250 | 08-18-2022 03:08 AM | |
| 1257 | 08-18-2022 03:05 AM | |
| 1090 | 08-18-2022 02:22 AM | |
| 1165 | 08-18-2022 01:45 AM | |
| 1173 | 08-18-2022 01:41 AM | |
| 1334 | 08-18-2022 12:05 AM | |
| 1563 | 08-17-2022 10:57 AM | |
| 5654 | 08-17-2022 02:07 AM | |
| 12967 | 08-17-2022 12:44 AM | |
| 1259 | 08-08-2022 12:24 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 08-18-2022 02:22 AM | |
| 2 Likes | 08-18-2022 12:05 AM | |
| 2 Likes | 08-17-2022 02:07 AM | |
| 10 Likes | 08-17-2022 12:44 AM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 2 Likes | |||
| 3 Likes |
User Badges
Community Statistics
| Member Since | 04-11-2019 03:16 AM |
| Date Last Visited | 05-16-2023 04:31 AM |
| Posts | 16 |
| Total Likes Received | 15 |
08-18-2022
03:08 AM
Did you restarted the services mentioned here by @parkerjr2 ? https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/another-week-another-btp-quirk-behavioral-threat-detected-rule/m-p/512183/highlight/true#M2597
... View more
08-18-2022
03:05 AM
Relevant VEEAM Kb https://www.veeam.com/kb1697 [....] Many anti-virus solutions have developed modules that monitor and prevent access to the boot configuration data (BCD). These "boot protection modules" have been observed to prevent Veeam's Application-Aware Processing processing from working with Domain Controllers. During the backup job's Application-Aware Processing step, for Domain Controllers only, the BCD is temporarily modified to enable SafeBoot. [...]
... View more
08-18-2022
02:22 AM
1 Kudo
Yeah I know but the "Boot in safe mode" abuse is all the rage right now and is actively used in the wild. PA stated that a CU with the fix has been released so I'll rather wait for it to be acquired by the agents.
... View more
08-18-2022
01:45 AM
Yeah thanks, unfortunately the KB is "please do an alert exception" but given the services involved I would not do that.
... View more
08-18-2022
01:41 AM
I think that the VSS is still blocked and the relevant services need a restart as noted in a previous comment.
... View more
08-18-2022
12:05 AM
2 Kudos
Got a ticket reply this early morning, FYI for everyone that had not opened a ticket
Comment: Hi Roberto,
We have released a KB article noting on this issue with Veeam Backup, for your reference,
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wlJGC
The Eng Team has deployed the fix in CU650-11590, please make sure affected endpoints are updated with this CU to avoid the prevention of Veeam Backup process.
We apologise for any inconvenience caused.
Regards,
Note: the kb article, at this moment, leads me to a salesforce error page
... View more
08-17-2022
10:57 AM
Ok so the workaround is to re-register the vss components and don't reboot, backups should run as expected. For the resolution, I think that a quick workaround could be check the value to which the reg key is setted, if is not one that cause a safeboot, raise an alert but not block the execution.
Post DEFCON shenanigans at it's best, seems to me..
... View more
08-17-2022
02:07 AM
2 Kudos
Our observed CGO
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt C:\Windows\system32\svchost.exe -k netsvcs C:\\Program Files (x86)\\Veeam\\Backup Transport\\VeeamTransportSvc.exe\""
All trying to modify a specific reg key:
key_name": "bcd00000000\\objects\\{d80ed0e8-d6da-11e7-b27f-ab3a45175c5d}\\elements\\25000080"
"value": "base64: AgAAAAAAAAA="
AgAAAAAAAA= it's a NULL sledge , effectively impeding the boot in safe mode. (valid values are: 0 = Minimal 1 = Network 2 = DsRepair)
... View more
08-17-2022
12:44 AM
10 Kudos
We are observing VEEAM VeeamTransportSvc.exe being blocked by BTP and, thus, preventing backups from being started.
We are working on a temporary fix excluding path and cgo and the likes but this is the second week in a row that content updates are screwing, this time impacting operations.
Already filled a support case.
BR
... View more
08-08-2022
12:24 AM
Support replied confirming the issue as a false positive that will be addressed in a minor CU release due this week.
In the meantime they suggested the creation of an alert exclusion for the CGO path and process for the affected agents only, to be removed after the CU is released.
Given the elusivity of the exploit, the fact that some bu are deaf on the necessity of quick patching and that for at least two endpoints there were a confirmed case of downloaded unsolicited email with office attachments, I will treat this case as a true positive, waiting for the CU to be released.
BR
... View more
08-05-2022
12:45 AM
Hi, we are observing the same behaviour on different customers, some of them are behind the patch level but others are not.. We are concerned over Follina too, because for some of the alerts we had confirmation of unsolicited mail with attachments but, for other systems, there were no reason for an alert...
... View more
06-08-2022
09:22 AM
Fantastic, this is what I hoped to be the case 🙂 So, content updates are not cached locally and are revoked / Replaced by PAN . Thank you!
... View more
06-08-2022
08:46 AM
Hi, thank you for your reply, but this has already been considered. What I don't know is the way the content updates are managed in the scenario depicted. What happens when a CU is going rogue and start to create problems to the endpoints were is deployed? In a delayed deployment , there is a method to exclude a specific content update from the available ones? This should be the ratio behind the delay , test a CU before deployment in a critical environment. But how can I be certain that a delayed, problematic update, won't be pushed to the agent? BR
... View more
06-08-2022
01:17 AM
Hi everyone, I was wondering how the content auto-update delay feature works when a CU borks a system. Last week we experienced a sudden spike in cpu and ram usage, and the affected machines crawled and stuttered, impacting production. Support told us to wait for a specific content update to be released, which would (as had been appened) correct the problem. So, in a scenario like this: Agent profile grp_CriticalServers : cu delay: 3 days. Agent profile grp_Workstations: cu delay: none day 0: CU 500-00001 released, applied on grp_Workstations , grp_CriticalServers still on CU 500-00000 day 1: CU 500-00001 works as expected day 2: CU 500-00002 wreak havoc on grp_Workstations, grp_CriticalServer still on 500-0000 day 3: CU 500-00003 and CU 500-00004 released , grp_Workstations now working normally. Question: at day 3, which content update will be served to the grp_CriticalServers? The last available 00004 ? 00001 and then after another 3 days, all the critical servers will be affected by the problematic CU 00002? In the first case, going straight to the last available come with some risks, the latter is not acceptable if there is no way to deprecate a CU. Or there is? The end goal is to use the vast majority of machines as canary for the critical servers. How did you manage a situation like that? Regards
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
05-16-2023
04:31 AM
|
Latest Tags
No tags yet
Likes From
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks