This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About SBDC
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About SBDC
05-01-2023
4Posts
2Likes
1Solution
May 01, 2023Last Visited
User
Activity
User
Profile
Latest posts by SBDC
| Subject | Views | Posted |
|---|---|---|
| 698 | 10-31-2022 12:41 AM | |
| 2739 | 01-06-2022 09:38 PM | |
| 2654 | 01-06-2022 09:20 PM | |
| 2715 | 01-06-2022 06:05 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 2 Likes | 01-06-2022 09:38 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 2 Likes |
User Badges
Community Statistics
| Member Since | 07-15-2015 07:59 PM |
| Date Last Visited | 05-01-2023 02:04 AM |
| Posts | 4 |
| Total Likes Received | 2 |
10-31-2022
12:41 AM
Actually, GootLoader is a separate malware/vulnerability, it is SEO poisoning targeting public sector agencies using the Gootkit malware kit.
Based on article written by Trend Micro, Gootkit loader uses fileless techniques to download and deliver various ransomware payload such as SunCrypt, and REvil (Sodinokibi) ransomware, Kronos trojans, and Cobalt Strike.
I also would like to know if there is detection pattern for PA firewalls.
... View more
- Tags:
- gootloader
01-06-2022
09:38 PM
2 Kudos
Okay, found the problem. We had a policy rule that included a lot of regions, and it appears "CE" (Crimea) is no longer valid as of pattern 8510.
Once I removed the region from the policies it was in, it compiled fine. Bit odd that Palo Alto did not document a removal of a region in the release notes.
... View more
01-06-2022
09:20 PM
Sadly no, that did not make a difference. Even re-downloaded the pattern.
... View more
01-06-2022
06:05 PM
We're running a PA-820 physical FW at software level 9.1.12-h3.
I tried to manually update the apps and threats pattern published this morning (as we only update daily and it was published about 30 minutes after our system automatically checks).
Downloading the pattern works fine, but when I try to install it, it gets to about 49%, then slows down massively, gets to about 59% progress and crashes (see screenshot below).
No idea what address "CE" is supposed to be, I can't find it anywhere. Pattern 8509 was fine...
Is the pattern/download corrupt, or is there something else to check?
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks