About mivaldi

I only got 3 stars by @laurence64, so I decided to add more info. 🙂 Edited my last post with additional information. I hope it is useful. ... View more

As @hisingh indicates, this typically happens when IoC domains are incorrectly being configured as FQDN Address Objects and used in the Destination Address in Security Policies. (There is another possibility which is related to the reporting engine picking up blocked websites or blocked domains to populate IP addresses in pre-defined threat reports).   This will cause the firewall to attempt DNS resolution on the FQDN Address Object, and populate an IP Address for Security Policy match. If the firewall's own DNS traffic is inspected by the firewall, it will trigger the associated Anti-spyware DNS signatures.   Using IoC domains in FQDN Address Objects is incorrect, or simply offers limited protection, since the resolved-ip for the domain from the firewall can be completely different than the resolved-ip from a host for the same domain.   The correct way to block IoC domains is to block them using Anti-spyware DNS. (If you instead did it on a Custom URL profile, you would only be protecting from HTTP based connections. Always keep in mind, when you talk IoC domains, you talk DNS traffic, not HTTP).   To populate custom entries into Anti-spyware DNS you need an EDL of type 'Domain List', pulling in a text file with the list of domains from a web-server. Make sure to set the new EDL of type 'Domain List' to a sinkhole or block action in the DNS Policies tab of the Anti-Spyware profile.   If you want to double-up for HTTP based traffic, that's fine and recommended, and the source text file with the list of domains used for the EDL of type 'Domain List' (i.e named 'ioc-domains-dns') can be repurposed on a separate EDL of type 'URL List' (i.e. named 'ioc-domains-url'), and *also* set it to block in the URL Filtering profile, or directly under the 'Service/URL Category' tab of a Security Policy with a configured Deny action.   And yes, you can triple-up by adding FQDN Address objects as a Destination Address in Security Policies, but just be aware of the hit-and-miss detection capability, and that DNS signatures sourced from the firewall will fire-up. You can find a way to except them by dedicating a Security Policy with the source IP of the firewall and no Anti-Spyware profile attached, or attached to an Anti-Spyware profile configured with specific Anti-Spyware DNS exceptions (the later being the best option since you can still detect other malicious DNS requests sourced from the firewall which may help detect the unlikely case of a compromised Firewall, but of course, not if the firewall is compromised *and* the threat actor is using the threat being excepted).   Furthermore, while you can create independent entries in a Custom URL FIltering profile, these can be used for URL Filtering or the Service/URL Category tab of a Security Policy but cannot be used to feed domains into the Anti-Spyware DNS profile. If you tried creating custom DNS Spyware signatures for the domains, these will be considered 'spyware' signatures and not 'spyware-dns' signatures, which will only allow you to configure a block action, (action 'sinkhole' is not configurable for custom DNS signatures). If you need to sinkhole, your only option with custom Domains is an EDL of type 'Domain List'. If blocking the DNS request is good enough, you can avoid having to host an external list, and you can instead create a custom Spyware signature for the domain. An example is available in this Tech Note (Page 20). If there are multiple domains to cover, they can be created using an OR in the custom signature definitions, or simply create one custom signature per domain.   After everything is configured, commit the configuration and test from a protected Host using the 'nslookup <domain>' command in a system terminal window. ... View more

Your DNS Server is likely sourcing multiple DNS queries re-using the same source port. When this happens and a threat is detected, a DISCARD session is installed, and all subsequent queries 'trip' over the DISCARD session. ... View more

No longer considered malicious. ... View more

You would need to open a case with Support. ... View more

We produced the following IPS signatures to cover this threat:   NAT Slipstreaming Detection (59667) NAT Slipstreaming Detection (59668) NAT Slipstreaming Detection (59669) NAT Slipstreaming Detection (59671) NAT Slipstreaming Detection (59672) ... View more

Please open a Support case. ... View more

This signature was disabled on  11/24/2020. ... View more

You can time-tag the source ip using a log forwarding profile built-in action.   Once the source is tagged, create an Address Group (Dynamic) (DAG) and set it to match the created tag.   You will then configure a Security Policy that will precede the current one being matched where the source is the DAG, and set the rule to Deny. The sources will remain tagged for the time lapse configured in the Log Forwarding profile built-in action, and after the time expires, they will be removed from the tag, therefore being matched again by the currently matched rule.   If you need instructions, I recently wrote an article on doing something similar to inhibit email alerts (retrigger timer). The article is not yet public because it is undergoing a revision process. If you need a copy please open a support case and ask for the case to be assigned to me. You can reference this post in the case. ... View more

URL's are HTTP traffic, so they don't get sinkholed. URL's are subject to URL Filtering. Sinkhole is applied to domains, which is DNS traffic.   Please open a Support case so we can work with you and understand the question better. We can come back to this post at the end of the case to share our findings with the community. ... View more

The Severity based rules are for Anti-Spyware. There is no Severity based rules for Anti-Spyware DNS. For Anti-Spyware DNS, you define actions based on Content DNS signatures, DNS Security DNS Categories, or EDL's of type Domain.   ... View more

Submitted ... View more

Verified that this sample is no longer considered malicious. ... View more

These are no longer considered malicious. ... View more