About Mohammed_Yasin

the Cortex install fails on the systems which already has Traps (previous EPP)   I have tried this command (below) which was recommended by Palo Alto, was working previously for few systems, but isn't the same now msiexec /i \\fps01\Users\rinesh.nanu.2\Cortex\Cortex_x64.msi CLEAN_AGGRESIVLY=1 /L*v \\fps01\Users\rinesh.nanu.2\Cortex\exc02\log.txt ... View more

We are seeing a high amount of traffic coming from outside public IPs to our exchange server. It's more than 2GB and sometimes more than 4GB of traffic. Initially, we blocked these IPs in firewall policy but every time after blocking the IPs, some more new public IPs keep coming with high traffic.   We are suspecting maybe it's some kind of attack because we don't see this high amount of traffic before. Need to investigate this to block the traffic if it's a kind of attack.   Is there any option to configure alerts to receive if anyone IPs utilizing more than 100MB of traffic? ... View more

In my case, the team is performing a vulnerability assessment on PA820 Vulnerability Title: Missing Secure Flag From SSL Cookie  Description: The Secure attribute tells the browser to only send the cookie if the request is being sent over a secure channel such as HTTPS. This will help protect the cookie from being passed over unencrypted requests. If the application can be accessed over both HTTP and HTTPS, then there is the potential that the cookie can be sent in cleartext.   The scanning was running to the MGMT IP,   How to find out the Missing Secure Flag on the SSL Cookie ... View more

In my case, the team is performing a vulnerability assessment on PA820 Vulnerability Title:   TCP timestamp response. Description:   The remote host responded with a TCP timestamp. The TCP timestamp response can be used to approximate the remote host's uptime, potentially aiding in further attacks. Additionally, some operating systems can be fingerprinted based on the behavior of their TCP timestamps.   The scanning was running to the MGMT IP,   How to disable the timestamp response. ... View more

In my case, the team is performing a vulnerability assessment on PA820 Vulnerability Title:   TCP timestamp response. Description:   The remote host responded with a TCP timestamp. The TCP timestamp response can be used to approximate the remote host's uptime, potentially aiding in further attacks. Additionally, some operating systems can be fingerprinted based on the behavior of their TCP timestamps.   The scanning was running to the MGMT IP,   How to disable the timestamp response. ... View more

creating a custom snort signature on Palo alto Firewall but didn’t found the concern context operator for match pattern. Shall we create a context operator or how it can add the pattern if the context operator is not available?   For example: alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"[CIS] Emotet C2 Traffic Using Form Data to Send Passwords"; content:"POST"; http_method; content:"Content-Type|3a 20|multipart/form-data|3b 20|boundary="; http_header; fast_pattern; content:"Content-Disposition|3a 20|form-data|3b 20|name=|22|"; http_client_body; content:!"------WebKitFormBoundary"; http_client_body; content:!"Cookie|3a|"; pcre:"/:?(chrome|firefox|safari|opera|ie|edge) passwords/i"; reference:url,cofense.com/flash-bulletin-emotet-epoch-1-changes-c2-communication/; sid:1; rev:2;)   Not available http_method http_client_body             ... View more

creating a custom snort signature on Palo alto Firewall but didn’t found the concern context operator for match pattern. Shall we create a context operator or how it can add the pattern if the context operator is not available?   For example: alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"[CIS] Emotet C2 Traffic Using Form Data to Send Passwords"; content:"POST"; http_method; content:"Content-Type|3a 20|multipart/form-data|3b 20|boundary="; http_header; fast_pattern; content:"Content-Disposition|3a 20|form-data|3b 20|name=|22|"; http_client_body; content:!"------WebKitFormBoundary"; http_client_body; content:!"Cookie|3a|"; pcre:"/:?(chrome|firefox|safari|opera|ie|edge) passwords/i"; reference:url,cofen   Not available   HTTP _ method HTTP _ client_body ... View more

The issue is that when I connected to a server through Global Protect, I can't connect to another server. I have to disconnect from Global Protect and then connect to the desired server. So basically he can connect to one server at a time. However, with Windows 10, version 1903 have no issue. But when I try to connect to Windows 10, version 2004 having an issue. Either could not connect to the server or if they connect to one server then I could not connect to another. I mean, I have to logout and from one and log in to another. Then I have upgraded the GP 4. 0. 4-9 to 5.2.2 but still, the issue is the same. Please advise on this issue. PA - 500 PANOS 8.1.15-h3 GP 5.2.2 ... View more