About jforsythe

  Playbook of the Week: Uncovering Unknown Malware Using SSDeep by Ido Van Dijk   Cryptographic hashes like MD5 are often used to identify malware, but as malware evolves, new iterations of the same malware are being released constantly. Malware may be modified or modify itself to avoid detection by traditional hashes. For example, in 2018,   12,000 variants   of the WannaCry ransomware were detected in the wild. SSDeep has proven effective in identifying malware of the same family, as large portions of the code usually remain the same between versions.   In this post, we’ll explain how to improve the detection, enrichment and investigation of malware by leveraging the power of SSDeep, a fuzzy hash often used in digital forensics, research and incident response. Yet, before talking about SSDeep, let’s talk about cryptographic hashes.     Cryptographic hashes vs. fuzzy hashes   Cryptographic hashes are used to identify data. In digital forensics, they serve as a means of identification of files. They are used to answer the question: “Is file X exactly the same as file Y?” A change in one bit of a file will cause a completely new cryptographic hash to be produced for that file. Some of the most commonly used cryptographic hashes are MD5, SHA-256 and SHA-512.   What exactly is SSDeep?   SSDeep is a fuzzy hash, and is a type of Context-Triggered Piecewise Hash (CTPH). It is calculated differently from the previously mentioned hashes, and is produced by running a hash function on fixed size segments of the file. This produces a special hash that answers the question: “Is file X similar to file Y?”. Therefore small changes in a file will only slightly alter the SSDeep hash it produces.   Let’s look at an example. Here are 2 files with the difference in only 1 byte:     Let’s look at the SHA-1 produced for those files:   As you can see, a completely different SHA-256 hash is produced for each file. Let’s take a look at the SSDeep hashes of those files:   The SSDeep hash is almost identical, except for one character difference. Why use fuzzy hashes?   As we saw before, cryptographic hashes can help us uniquely identify malware. If we find a suspicious file, we can query our threat intelligence products to see whether they know about its MD5 hash, and we may get insightful results about the malware. However, if the malware we are investigating was forked and made the slightest modification of a string for example, then the method of enriching it using its MD5 hash may not yield any results at all, unless that exact fork is known to the threat intelligence product we are using.   This is where SSDeep comes in.   SSDeep is a common implementation of CTPH. The “ssdeep” command is a native command in Unix systems, and it has a built-in function that allows us to find files with similar SSDeep hashes. We may find out that we have just investigated a very similar malware the week before, which has a similar SSDeep, but its MD5 hash is not known to any of our sources.   Leveraging SSDeep in XSOAR to uncover unknown malware   Combining SSDeep with Cortex XSOAR provides a tremendous value due to the following capabilities:   Threat Intelligence Management (TIM) module Fetch indicators from feeds. Fetch indicators from incidents. Get reputation based on multiple sources (sandbox. threat intel, manual). Build relationships between entities. Integration Integrate with threat intelligence products for indicator enrichment. Integrate with EDRs, firewalls, email security gateways and more - to provide a holistic remediation plan. Automation Automatically detect files with similar hashes. Automatically hunt for files in endpoints. Automatically remediate. Case Management Link similar incidents together. Display all relevant information in a special custom layout. Taking into account all of the tools we have, we created the following general flow in an XSOAR playbook: We obtain an MD5 hash from an alert on one of our endpoints. We retrieve the file from the endpoint, to obtain its SSDeep hash. We generate a pool of SSDeep hashes that we know about. We use existing SSDeeps in our system (from various feeds and incidents we have), and we enrich other hash types using threat intelligence tools to obtain even more SSDeep hashes.     4. We use an automation we provide out of the box called SSDeepSimilarity, to find similarities between the file we started with and the SSDeep hashes from the pool.       5. We begin to pivot: - We create relationships between our original hash and previously unknown hashes by uncovering the SSDeep similarity of the original SSDeep hash and the hashes from the hash pool. - We link the current incident with another incident where the similar hash came from. This provides us with additional IOCs which may be related to the malware we are investigating. - We search for the similar hashes we found on our endpoints, and we detect one of them on an endpoint.     6. Finally, we save all of our findings in the incident layout and allow for remediation of any malicious indicators found in our investigation.   To start using the  SSDeep content  pack, visit the Cortex XSOAR marketplace. For more information on SSDeep, check out the  SSDeep project  or  detailed research  on the value of fuzzy hashing in malware analysis.   Don’t have Cortex XSOAR? Download our free   Community Edition   today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC.   ... View more

How to automate NGFW management using Cortex XSOAR By Danil Vilenchik, Sr. Technical Program Manager   Today’s security operations centers (SOCs) are plagued with lengthy investigation times and security teams are often drowning in repeatable, manual tasks. Combine these challenges with the tedious and time-consuming task of firewall management, and it's no wonder that   more than one-third   of IT professionals are considering quitting their job in the next six months.   Fortunately, there are solutions that exist to help automate many of the SOC’s most common processes, relieving some of the burden faced by security analysts. In this post, we’ll take a deeper look into the   PAN-OS by Palo Alto Networks   content pack for Cortex XSOAR, which assists in managing firewall objects, rules and policies as well as the firewall instances themselves. This helps create a safer browsing environment and block unwanted traffic flowing into and out of organizations.   What is PAN-OS?   PAN-OS   is the software that runs all Palo Alto Networks® next-generation firewalls. By leveraging the key technologies that are built into PAN-OS natively (App-ID, Content-ID, Device-ID, and User-ID) you can have complete visibility and control of the applications in use across all users and devices in all locations. Because inline ML and application and threat signatures automatically reprogram firewalls with the latest intelligence, all traffic on your network is free of known and unknown threats.   Benefits of the PAN-OS content pack   The   PAN-OS   content pack for Cortex XSOAR enables SOC teams to create and manage security rules, update security policies, make sure devices and policies meet security best practices and take action when needed for device management. Over 250 manual commands can be executed from the XSOAR CLI and 18 generic playbooks help automate security and network operations. Utilizing Cortex XSOAR to control and manage network security operations consolidates security tools and many of the out-of-the-box commands can be used to further build playbooks to eliminate manual actions.   Integrating PAN-OS with XSOAR helps to automate many of the time-consuming tasks associated with firewall operation and management, freeing up SOC teams to work on more critical security issues.   See Cortex XSOAR and PAN-OS in action   Let’s look at how Cortex XSOAR and PAN-OS can automate basic remediation steps.   When a new malicious IP or URL indicator is detected in Cortex XSOAR, it automatically triggers a playbook that adds the malicious indicator to a block list. The playbook first checks to see if the address already exists in the block list, and if not, the indicator is added.   PAN-OS - Block IP - Static Address Group playbook   This may seem like a simple task that can be performed manually, but in reality, when analysts are flooded with many tasks and pending investigations, it becomes critical to remove items from their list of actions. Cortex XSOAR can help! Automating processes is one of the key pillars of SOAR solutions. Real threats won’t go ignored or even missed, and indicators can be quickly found within your environment to follow up with further investigation.   Threat-hunting made easy with XSOAR and PAN-OS   XSOAR can automatically run through your PAN-OS logs each time a new IOC is detected.   Proactive hunting is important to keep your environment safe, and as daily security incidents and escalations flood the SOC, high-tier analysts and engineers will no longer have to waste their time running queries on FW logs.   PAN-OS Query Logs For Indicators playbook   Each malicious file (hash), URL and IP fetched into XSOAR is automatically queried by this playbook in up to six different logs in your PAN-OS instance, including   Wildfire   malware protection engine, threat, traffic, data and more.   Palo Alto Networks offers a whole suite of best-of-breed security solutions. Implementing the   PAN-OS by Palo Alto Networks   content pack in your standard workflows can save time that is normally wasted on basic manual actions and allow your security personnel to focus on other responsibilities, shorten SLAs and increase SOC efficiency.   For more information on the PAN-OS by Palo Alto Networks content pack, refer to the developer article   here. If you like these ideas or would like to suggest other ideas, please collaborate with us through the   Cortex XSOAR Aha   page. Please suggest ideas or vote for others.   Don’t have Cortex XSOAR? Download our free   Community Edition   today to test out this playbook and hundreds more automations for common use cases you deal with daily in your security operations or SOC. ... View more

Symphony 2023: Journey to the Modern SOC   Symphony 2023 is back!   Our annual conference is designed to help you solve your most pressing SOC challenges. Symphony brings together the brightest minds in cybersecurity and security operations (SecOps) to share strategies, elevate the role of SecOps and empower you to proactively defend your organization. Join us on a journey to the modern SOC, where we will share best practices and innovative techniques you can immediately use to improve your SecOps practice in a meaningful way. Plus, we’ll share our vision for transforming the SecOps model as we know it. Register for Symphony 2023 to learn:   Our vision for the future, outlining leading cybersecurity strategies and practices. The latest intelligence and insights into today’s threat landscape. SOC innovation with Cortex® product deep dives, hands-on workshops and new launch announcements.   Register for Symphony 2023 today!   ... View more

A retrospective look at the accomplishments and highlights from LIVEcommunity in 2022.   Can you believe another year has come and gone? These past 12 months have no doubt been eventful and we’d like to take a moment to reflect on all that was accomplished.   In 2022, LIVEcommunity made significant improvements. We redesigned our homepage navigation, developed new product pages and customer journey guides, won our first big industry award, published hundreds of helpful blogs and articles, and our members continued to engage in the kind of problem-solving and solution-finding that sets this global community apart.    The LIVEcommunity team appreciates all of those who visited us in 2022, and would like to extend a special thank you to users who provided feedback in the form of comments, mentions, thumbs up/kudos, and replies to posts. We wouldn’t be this vibrant community without each and every one of you!    2022 in LIVEcommunity: By the Numbers   PAGE VIEWS 9,562,584   VISITS 5,242,336     POSTS 21,336   KUDOS GIVEN 6,844   ACCEPTED SOLUTIONS 1,324   LIVEcommunity's Most Popular Blogs From 2022   New Advanced URL Filtering/PANDB Category: Ransomware New Advanced URL Filtering/PANDB Category: Encrypted-DNS Tips & Tricks: How to Ping from the CLI  DOTW: GlobalProtect Virtual Adapter Was Not Set Up Correctly Due to a Delay  Russia-Ukraine Cyber Activity Resources   2022 LIVEcommunity Highlights   LIVEcommunity Won a 2022 Khoros Kudos Award   One of our greatest achievements in 2022 was winning a Khoros Kudos Award . This is the first year LIVEcommunity won a Khoros Kudos award, and we hope it signifies our steadfast commitment to our members and Palo Alto Networks customers around the world.   We Built a New Member Recognition Area!     LIVEcommunity is nothing without its members, which is why we launched a new Member Recognition area earlier this fall.    The Member Recognition area features our Cyber Elite Program and Spotlight News. In the Cyber Elite Program area, you’ll find information about each of our Cyber Elite experts, as well as details about the program (more on that below), while in the Spotlight News area, you'll find our monthly Member Spotlight series which highlights members that have been active in posting discussions, making comments, and giving likes.   LIVEcommunity Welcomed Our 2022-23 Cyber Elite Cohort     ​​ The LIVEcommunity team wants to give a shout-out to our 2022 Cyber Elite experts ! Cyber Elite experts are highly knowledgeable and engaged members who go above and beyond in their contribution to community.   Earlier this year, we welcomed two new Cyber Elites to this group of super-users, @PavelK and @TomYoung. Thank you to all 11 of our Cyber Elite experts who make this online community as vibrant, helpful, and connected as it is!   PANCast, a Palo Alto Networks Podcast, Launched     Have you listened to PANCast yet? This Palo Alto Networks podcast provides actionable insights from cybersecurity experts to customers; episodes will cover a range of Palo Alto Networks products, offering valuable tips and key information for a successful adoption journey. Check out these episodes from @jarena :    PANCast Episode 1: Four Things You Must Do When Upgrading Your Firewall PANCast Episode 2: How Does GlobalProtect Split Tunneling Work? PANCast Episode 3: URL Filtering — Allowing and Blocking the Right Traffic PANCast Episode 4: Why Is My Dataplane CPU So High? PANCast Episode 5: Why Logs Are Your Best Friend PANCast Episode 6: Understanding Firewall Security Policies PANCast Episode 7: What to Know When Migrating to a Palo Alto Networks Firewall   We Introduced Nominated Discussions for the Community Knowledge Base   LIVEcommunity moderators can now nominate a discussion topic to be an article. This is a great way for members to be able to contribute to our community knowledge base. Here’s a list of our favorite member-posted discussions we turned into articles in 2022:   Palo Alto Free Workshops, Trainings, Trials, and PCNSA/PCNSE Training Global Protect Authentication Happened Two Time While Using RADIUS URL Filtering Profile Set to Allow Ransomware Dual ISP Global Protect Redundancy   Thank you for contributing meaningful topics, replies, and solutions to LIVEcommunity's reservoir of knowledge!   LIVEcommunity Got a New Navigation Bar     Earlier this year, LIVEcommunity updated its homepage navigation! We simplified the navbar and drop-downs in an effort to fine-tune way-finding, organization, and overall user experience. Rather than having blogs, articles, and discussion hidden under Collaboration, these important LIVEcommunity resources now have their own spots in the nav. Products and Tools now have their own drop-downs, where you can hover to find your relevant assets.   Learn all about the changes here .   We Unveiled Cloud NGFW for AWS Help Center       Earlier this spring, Palo Alto Networks announced Cloud NGFW along with Amazon Web Services (AWS). Managed by Palo Alto Networks and easily procured in the AWS Marketplace, the service has been designed to easily deliver our best-in-class security protections with AWS simplicity and scale.   LIVEcommunity’s Cloud NGFW for AWS Help Center page is where you will find FAQs, videos, technical resources, discussions, blogs, and articles related to the deployment and use of Cloud NGFW for AWS. Check it out now.   New Customer Configuration Centers for NGFW and Panorama   In an effort to better serve our customers, LIVEcommunity enabled new, customized configuration help centers for Next-Generation Firewall and Panorama in 2022.   We want our customers to have the tools they need to properly configure, setup, and deploy their products. These new customer configuration areas for NGFW and Panorama are home to key documentation and resources to support your configuration needs. The customer Configuration Centers are available to you every day, all day.   Check them out now: Panorama Customer Configuration Center Next-Generation Firewall Customer Configuration Center    We Created New Technology Pages:   One of our main goals in LIVEcommunity is being home to the newest and most up-to-date resources on Palo Alto Networks technology. This year, we launched a several new technology pages:   Cloud NGFW for AWS Help Center AIOps for NGFW Prisma SD-WAN (including a Customer Journey Guide and Self-Help Resources )  Panorama Customer Configuration Center NGFW Customer Configuration Center Best Practice Assessment Plus (BPA+) Prisma Access for Multi-Tenant Platform (MSPs)   We hope these pages help you in adopting, leveraging, and learning about your Palo Alto Networks product.   As we say goodbye to 2022 and hello to 2023, we want to THANK YOU for being an integral part of our members' success and exemplifying the true meaning of “community.”    LIVEcommunity is Now Available in Chinese In 2022, LIVEcommunity launched a brand new community in Simplified Chinese. You can find it and Japan at the top of our navigation on our homepage.    Thank you to our global community for making 2022 such a successful year. Here's to an even better 2023!   ... View more

December 2022 Rewind: Top posts from LIVEcommunity   Welcome to our December 2022 Rewind, where we review some of LIVEcommunity’s biggest headlines from the past month!   In December, we attended Ignite and connected with some LIVEcommunity members IRL; discussed new networking features in PAN-OS 11.0 Nova with the community; shared new episodes of PANCast, a Palo Alto Networks podcast; and much more. Read on to see what you missed in LIVEcommunity in December, a noteworthy finale to 2022 🎉 .   Ignite '22 Recap   Another Ignite conference comes to an end! If you joined us last week in Vegas for Palo Alto Networks annual cybersecurity conference, Ignite 2022, we want to thank you for stopping by the LIVEcommunity booth. If you missed this year's sessions, don’t worry: many of them can be watched on-demand by logging into your account on the Ignite page and clicking on the top right-hand side menu.   The LIVEcommunity team also wants to extend a big thank you to our very own Cyber Elite experts @BPry , @TomYoung , and @MP18 for hanging with us at Ignite. Check them out playing Topgolf with LIVEcommunity manager @crasmussen.    We can’t wait to see you next year at Ignite ‘23!   Cyber Elite Spotlight Interviews: @PavelK  & @TomYoung    This month we got to know LIVEcommunity Cyber Elite experts @PavelK  and @TomYoung  via our Spotlight Interview series.   Our Cyber Elite members are among LIVEcommunity's top contributors and we are excited to be featuring them via our community interviews!  Read our interviews with these two incredibly active and knowledgeable members now to learn more about who they are, their experience with Palo Alto Networks products, journeys in cybersecurity, and of course, the significance of being a LIVEcommunity Cyber Elite expert.   Pavel, who hails from Czech Republic, started his career as a System Administrator before becoming a Network Engineer and focusing on cybersecurity. He has more than 15 years of IT experience and holds his CCIE, which you can read more about in our Cyber Elite Spotlight Interview with @PavelK.   Tom is a Principal Network Architect and a four-time CCIE/CCDE, PNCSC/PCNSE with more than 20 years of networking/security experience. Read our Cyber Elite Spotlight Interview with @TomYoung now.   New Episodes of PANCast, a Palo Alto Networks Podcast   PANCast, a Palo Alto Networks podcast that provides actionable insights to customers, has two new episodes! Check them out now:   PANCast Episode 6: Understanding Firewall Security Policies     A firewall security policy may seem straight-forward enough, but with its suite of complementary features — appID, userID, URL filtering, SSL decryption, and more — it’s worthwhile to dig into how your policy actually works. Listen to this episode now for a refresher on the importance of security profiles and how Palo Alto Networks’ Best Practice Assessment Tool can help.   PANCast Episode 7: What to Know When Migrating to a Palo Alto Networks Firewall   All devices work differently and engineers might face challenges when migrating from one platform to another. In this episode of PANCast, learn key aspects of firewall migration, how to spot common issues when migrating to a Palo Alto Networks firewall and, more importantly, how to fix them.   New Networking Features with PAN-OS 11.0   Palo Alto Networks launched PAN-OS 11.0 Nova last month, including new advanced features and hardware .   For all the security folk who began their careers in networking, have you seen the new networking features for PAN-OS 11.0? There are many rich features like the PAN-OS integrated web proxy. Customers who require a legacy proxy in their environment can now leverage PAN-OS as a unified platform for maintaining the boundary edge. Check out all of the cool, new  networking features for PAN-OS 11.0 Nova in this chart .    Playbook of the Week: Securing the Cloud with Cortex XSOAR and Prisma Cloud The number of risks and threats make securing cloud-based infrastructure, applications, and data extremely critical. Fortunately, Prisma Cloud was designed to secure infrastructure, workloads, and applications, across the entire cloud-native technology stack — throughout the development lifecycle and across hybrid and multi-cloud environments. Read more about Automating Incident Response with the Prisma Cloud content pack.   Palo Alto Networks Introduces Medical IoT Security     Palo Alto Networks has announced a solution for healthcare providers: Medical IoT Security.   In response to the life-threatening attacks on connected healthcare devices, Palo Alto Networks designed a solution purpose-built to protect them. Medical IoT Security, based on the principles of Zero Trust security, provides comprehensive protection for connected medical devices that have exposed healthcare providers to the brunt of cybercriminals’ nefarious attacks. Read more about the benefits of Zero Trust IoT Security from Palo Alto Networks from @msehgal.   Announcing AIOps for NGFW 2.5   Palo Alto Networks is proud to announce the availability of AIOps for NGFW 2.5 and its new features that help customers improve the operational efficiency of managing firewalls. Read the blog to find out about improved Best Practice Assessments, security posture overview, dynamic thresholds and more.   Tips & Tricks: How to Harden Your Admin Access   You wouldn't leave your front door open. So why would you leave your firewall wide open?  It can be shocking how many people leave their firewall vulnerable, simply because they never bothered to change the default password.   Check out three simple tips for hardening your admin access from @kiwi now.   Dec ‘22 Discussion Highlight: Posts With Accepted Solutions   Nominated Discussions help LIVEcommunity Solutions Engineers highlight a discussion that has an Accepted Solution , and turn it into an article with additional helpful information, documentation, and clarity! Here are the Nominated Discussions we published this past month:   How to Implement BGP and eBGP on Palo Alto Networks LocalDB User Can't Change Password Update Multiple Categories Within All Security Profiles W/ the CLI   More LIVEcommunity posts published in December:   OWASSRF Vulnerability Exploitation Accessing UID-Agent or AD When Your Management Interface is OOB Automatic Incident Enrichment with XSOAR How to Defend From a Distributed Denial of Service (DDoS) Attack Cortex XSOAR: Why We Automate Processes Find and Fix Your Unknown Risk With Active Attack Surface Management Prisma Access 3.2.1 Update Cloud NGFW for AWS How to Video: Multi-VPC Cloud NGFW resource Introducing the Cortex Help Center Integrate Elasticsearch Into Your Incident Management Playbooks Using XSOAR   You're now fully briefed on LIVEcommunity's December 2022 highlights!   If this was helpful, be sure to give this blog a thumbs up. See you next month! ... View more