About r_gine

r_gine · ‎12-11-2018

I’m having an issue identifying the offending file that triggered a vulnerability detection. We had an IT admin transfer a large batch of files across a network segment that traveled on of or PA firewllls. One of the transfers triggered an alert for an Adobe Reader remote code execution signature. The “file name” in Panorama shows “content.xml” but does not show the actual name of the file that contained code that matched the signature. How does one find the actual offending file in instances like this? We’ve encounteed similar issues with the virus profile too. During the transfer of files the palo will alert on a virus detection but will not show the actual name of the malicious file. This makes response very challenging.

r_gine · ‎10-10-2018

I'm curious if you ever got this working? I'm interested in pulling in CS IoC data into MineMeld

r_gine · ‎10-26-2017

Outside of WildFire... The Firewall calculates file hashes for all files so why don't they log that information? WildFire is a pretty poor sandbox appliance.

r_gine · ‎10-26-2017

I dont even see how this is possible... why would they not store this information? This is insane -- this information is would be very useful from a security monitoring and threat intelligence aspect.

r_gine · ‎06-21-2017

Does anybody know where to find the associated file hashes for files from the threat or data filtering log? I know Palo is generating file hashes on files because that's how they're determing what to send to WildFire but I can't find a file lash log anywhere. I would like to see this in the data filtering log.

r_gine · ‎12-14-2016

So I'm surprised that the Palo Alto doesn't have a signature to detect OpenVAS scanners. I would like to create a simple rule that detects "User-Agent: OpenVAS" (Ultimately I would like to just block these entirely. Is something that can be easily built?

r_gine · ‎09-03-2015

Thanks -- I don't think I was very clear in asking my question. For this example, let's consider the case of an SMTP message with an attachment (Word Doc). (assuming the Palo is configured to forward all file types to the WildFire public cloud for malware analysis) 1. If the data filtering log were to show 'wildfire-upload-skip', one could conclude that that file (hash) had been previously seen by WildFire. The file would not be uploaded to WildFire for analysis. If that file was deemed do be malicious by WildFire, the file would be 'Denied' and probably recieve a 'subtype' of 'wildfire-virus'. 2. If the data filtering log were to show 'wildfire-upload-success', one could conclude that the file had not seen before by WildFire and that the file would allowed through the filewall (and on to the e-mail gateway and mail server). At this point, I want to know if that file/hash comes back from WF categorized as 'malicious'. We are not logging 'benign' results from WildFire. I made the assumption that when I look in the 'WildFire Submission' log, those would show me the WF submissions that returned as malicious (and had been previously allowed through into the net work) however when I search for those files in my mail server and gateway, they're not there.

r_gine · ‎09-02-2015

Wondering how others are tracking down files that were allowed through the firewall but later determined to be malicious (as a result of WF analysis)

r_gine · ‎08-06-2015

I'm having trouble determining which malware has already been seen by WildFire (therefore it was not re-sent for analysis and blocked by the FW) vs. a file that our organization sent to WF and was determined to be malicious after analysis (not seen before by WF) . This would significantly help our organization respond to malicious files that may have made it to internal systems (mail servers, desktop, etc). Right now, I go into the analysis report and look at the first seen date... I know there's a better way. Thanks!

Date Registered	‎08-06-2015 08:29 AM
Date Last Visited	‎10-29-2019 06:58 PM
Total Messages Posted	10
Total Likes Received	1

Online Status	Offline
Date Last Visited	‎10-29-2019 06:58 PM

About r_gine

Finding the offending file associated with threat event

Re: Minemeld Miner Integration with 3rd Party Threat Intelligence using API

Re: File Hashes?

Re: File Hashes?

File Hashes?

Finding the offending file associated with threat event

Minemeld Miner Integration with 3rd Party Threat Intelligence using API

Finding the offending file associated with threat event

Re: Minemeld Miner Integration with 3rd Party Threat Intelligence using API

Re: File Hashes?

Re: File Hashes?

File Hashes?

Basic Rule to Detect/Alert on OvenVas Scanners

Re: Identifying files that were 'allowed' but are know known to be malicious

Identifying files that were 'allowed' but are now known to be malicious

Trouble differentiating between malware already seen by WildFire and malware 'first seen' by WildFire

Strata

Prisma

Cortex

About r_gine