About mivaldi

mivaldi

Check your URL Filtering logs.

mivaldi

It is possible that the firewall is taking a discard action early, before policy-lookup, where the destination data in the packet is evaluated. Open a Support case to get additional insight.

mivaldi

This can be caused by the firewall running DNS proxy, or attempting to fill out the IP information in pre-defined threat reports. Check your Threat logs to see if these domains have been observed, and verify the threat reports to see if any generated reporting the malicious domain findings.

mivaldi

Sample no longer considered malicious

mivaldi

No longer considered malicious

mivaldi

Submitted for analysis

mivaldi

Submitted for analysis.

mivaldi · Re: Positive Removal Request WPD 1.3.1532

Sample no longer considered malicious.

mivaldi

Port 5007 is used by User-ID redistribution. If you are not using User-ID redistribution you should close the service (and therefore the port will be closed). To disable the service check the Management Interface Profile tied to the Interface, and disable the User-ID service.

mivaldi

Query your traffic logs for denied traffic where your SMTP server is the source address.

mivaldi · Re: Positive Removal Request WPD 1.3.1532

Submitted for analysis

mivaldi

Sample no longer considered malicious.

mivaldi

Submitted for analysis

mivaldi

The sample is no longer considered malicious.

mivaldi

Yes, no longer considered malicious.

mivaldi

Virus/Win32.WGeneric.ajruiw is disabled and will be removed from tomorrow's release of Antivirus. Please open a Support case to investigate the Vulnerability FP.

mivaldi

Submitted for analysis

mivaldi

Submitted for analysis

mivaldi

Sample no longer marked malicious.

mivaldi

This is a forum for non-customers to request WildFire reconsideration of malicious sample verdicts observed in VirusTotal, so it is not the right place to submit your question. Please open a Support case to have your issue investigated.

mivaldi

Submitted for analysis.

mivaldi

Please open a Support case to have us take a closer look.

mivaldi

There should be a lot of information in correlated log entries. At the very left of the threat log entry, you will see a magnifying glass icon. Click it and that will open the detailed log view. On the lower panel, you will see correlated log entries. You can see correlated traffic log entries, URL filtering log entries, and wildfire submissions as well as other possible entries. These other entries will exist if these additional features were properly configured to log an event.

mivaldi

Signature Release Hashes Name: Virus/Win32.WGeneric.ajbsuc Unique Threat ID: 341044866 Create Time: 2020-04-08 19:03:39 (UTC) Threat ID: 2565506 Current Release: 3348 (2020-05-13 UTC) First Release: 3312 (2020-04-08 UTC) 78487e9f4dcd78f24a8b863e5b4cf15b9a4fcb6a78f2a8477ad43fe5639e4a04 Signature Release Hashes Name: Virus/Win32.WGeneric.ajbecg Unique Threat ID: 340897548 Create Time: 2020-04-07 20:22:17 (UTC) Threat ID: 2005534 Current Release: 3348 (2020-05-13 UTC) First Release: 3311 (2020-04-07 UTC) c39cb7067c3c5c22802bafe4d54b3365b1f24bab864ba6ba75c3e069d96d09b0 Signature Release Hashes Name: Virus/Win32.WGeneric.aeqdlm Unique Threat ID: 295866360 Create Time: 2019-08-21 09:26:56 (UTC) Threat ID: 2636376 Current Release: 3348 (2020-05-13 UTC) First Release: 3079 (2019-08-22 UTC) 2c96ca9abb21a87e0967de6ef78f76083f3917ecf2ba5ed69acd044582b0e3dc 9a2fcee13a376a99a0856c226bdce391f357a9ba766236accc4f74a02103a5ba 214f934a95dc68bf17aba4acd7f66babc692c544a1fa848e80eb7d4fc7c4e3c1 0cfdb09b489b7003577bd905a541b514a74232b2e4d3f51b0bf62998106e5fec

mivaldi

The best way to investigate these would be to access the Threat Vault at https://threatvault.paloaltonetworks.com/ Search for the Threat ID's and find the SHA256 hashes of the samples tied to the signatures. You can then use the SHA256 hashes to research the samples on the internet. A good place to begin that research is http://virustotal.com If you believe the signatures are built based on WildFire false positives or potential Signature Collisions you can open a request with Support to investigate. If you know for sure that these triggers are false positives, and they're interrupting critical business tasks, you can opt to create an exception in your Antivirus profile. You can see instructions at https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/threat-prevention/create-threat-exceptions

mivaldi

Try this: # configure # delete deviceconfig system ssh # set deviceconfig system ssh ciphers mgmt aes256-ctr # set deviceconfig system ssh default-hostkey mgmt key-type ECDSA 256 # set deviceconfig system ssh regenerate-hostkeys mgmt key-type ECDSA key-length 256 # set deviceconfig system ssh session-rekey mgmt interval 3600 # set deviceconfig system ssh mac mgmt hmac-sha2-256 # commit # exit > set ssh service-restart mgmt

mivaldi

This sample is no longer considered malicious.

mivaldi

The reported sample is no longer considered malicious.

mivaldi

Submitted for analysis.

mivaldi

I noticed you place these requests regularly. If you begin signing your binaries, we can look into whitelisting your signer, so you don't have to do this every time there's a new version of the software. I submitted a request to analyze this sample.

Date Registered	‎04-03-2014 01:35 PM
Date Last Visited	yesterday
Total Messages Posted	589
Total Likes Received	104

Online Status	Offline
Date Last Visited	yesterday

Strata

Prisma

Cortex

About mivaldi