About tettema

Hi Johan, Looks like you've had some fun taking a look at WildFire's detection logic.  I wanted to take the opportunity to address some of your findings just to clarify some of the items presented: 1.  Your first three tests use custom binaries that open reverse shells as the "malicious behavior".  Opening a reverse shell that never connects to bind to a shell is not something that can really be used to detect malware.  If you start a reverse shell without successfully binding, all it really looks like is an attempted TCP connection.  Since all we see in the sandbox is a failed TCP connection, there is nothing useful here to call the sample malware.  Furthermore, the IP address chosen by your application is in private address space.  Calling programs malware when all they do is open a TCP socket on private address space would quickly lead to problems. 2.  If your sample were to perform a reverse shell to an external IP and actually bind to a server listening for the shell, the Palo Alto Networks IPS would have caught that reverse shell and triggered a critical reverse shell alert.  If you are blocking on IPS signatures, this shell would have also been blocked, preventing the interactive session from taking place. 3.  In the final test, you take malware (which was confirmed as malware by WildFire), run it through pescrambler, and run it through WildFire again to see if we can detect it as malware.  The test comes back benign, and you'll notice that one of the behaviors observed is that the sample crashed when loaded.  This is because pescrambler corrupted the EXE making it unloadable.  In fact if you run it in your own environment, it crashes immediately.  The pescrambler tool looks like it hasn't been updated in some time, and in fact has an open issue (https://code.google.com/p/pescrambler/issues/detail?id=1) describing the fact that it corrupts EXEs.  Given that the sample doesn't successfully run, I wouldn't call this a false negative.  In fact, any static file obfuscator like pescrambler is more useful in evading AV signatures, and not in evading dynamic sandbox-based analysis tools like WildFire.  Scrambling a PE file causes the file image to change, but once it's running, WildFire doesn't care whether the file was scrambled or not.  WildFire is looking at the runtime behaviors of the sample as it runs in the sandbox, regardless of how the PE file was obfuscated. Having said all that, WildFire will never catch 100% but it is a valuable addition to our threat prevention technology stack in catching malware that evades the other layers of defense.  If you have any other findings you would like to bring to our attention, please let us know or you can also reach out to me directly. Thanks, Taylor Ettema Product Manager, Threat Prevention ... View more

Hi all, We have identified an issue with this signature and will be correcting the issue in the next content update on Feb 5th. ... View more

Hi David, I would suggest the following: Signature 1: Match "/ajax_modal/modal/data.asp" in http-req-uri-path, and "&state=" in http-req-params Signature 2: Match "User-Agent\x3A\x you \x0D 0A\x" in http-req-headers. ... View more

The signature matching engine requires that each pattern have a 7-byte (consecutive) static string somewhere in the pattern. ... View more

Hi Manfred, I'd like to understand the test setup a little more.  Anything the firewall blocks should be blocked consistently.  If you are using a browser, it is possible that the browser is caching data and reserving it to you.  Are you using a block action or a continue action in your AV profile?  Which ones specifically are you seeing this behavior with, and can you describe the sequence of actions in detail? ... View more

Hi Kalyan, Please open a support ticket so we can look into this and get it resolved for you. ... View more

Hi Tomohiro, This signature is looking for use of double- and triple-encoded data within PDFs.  This is a commen evasion technique that malicious PDFs use to hide their malicious payload.  However, legimate PDFs can sometimes use double- (and perhaps triple-) encoded data as well, and so this signature is rated as "informational".  In fact, some PDF reports generated by the Palo Alto Networks firewalls can trigger this informational signature. This signature, just like any other informational signature, is not the highest priority and should not necessarily trigger immediate alarm, however keeping an eye on instances of this alert for PDFs from untrusted sources is a good idea. ... View more