About Indorama_Ventures

Wireshark reveiled that it was a webservice that tried to contact the Synology. From there, I guess it tried to open the SMB share on the computer.  Although not visible on the computer itself it was a browser session on tcp/5000 which initiated the connection.  ... View more

Good tip... Will do! ... View more

Yes, according to the firewall it is the same client (IP address).  Unfortunately I can determine what is causing the SMB traffic. There is simply nothing open on the client.  Every 2 hours or so I see a whole bunch of warnings appear in the logs of the firewall. Then it is silent again after which the process repeats itself.   Very weird ?!?!?   Remko ... View more

Thanks, I do see a couple of bloomfilter entries appear   num of bloomfilter requests sent : 13 num of bloomfilter response received : 12 num of bloomfilter response failed to proc : 0 num of bloomfilter resize requests sent : 0 Last heard(seconds ago) : 4 So I guess we are on the right track ?    I put "domain users" in the "Allowed RODC Password Replication Group" But also my personal testing account in the case there might be a problem with nested groups.   Then I tried  two different URL categories for the password credential submission One for my personal NAS device (computers-and-internet-info) at home and one for NetFlix (streaming-media)  But if I enter any domain credentials, they are not detected. Both websites simply say the credentials are not valid.           ... View more

@Chacko42 : Thanks for your reply. How would you check this via the commandline? I did a quick Google Search but was not able to find this. Can you advise? ... View more

Hmmm,  Can't seem to get this to work. Whatever I try, the Palo Alto does not detect any user credential submission. Tried various websites and categories to put the URL credential submission to block.  But unfortunately, no luck whatsoever.  I think I am going to put this aside for a while and try some other time.  This is causing to much frustration 🙂   Remko ... View more

Hi Laura, thanks for your reply. I have downgraded the client further to version 8.1.5-6. It appears to be working correctly as long as it runs with the local system account In the log I see a whole bunch of entries appearing   When I edit the UserIdentification setup and save it, the service starts to run with the RODC_Service account. This account has the correct priviledges according to this article https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClEuCAK But but the service fails to start when started with this new account   06/04/19 11:19:03:448[Error 2382]: Start error -1!! 06/04/19 11:19:03:448[Error 764]: Device listening thread stops timeout! 06/04/19 11:19:45:694[ Info 2357]: ------------Service is being started------------ 06/04/19 11:19:45:694[ Info 2364]: Os version is 6.2.0. 06/04/19 11:19:45:694[Error 675]: Cannot open config reg log key with error 5(Access is denied. As said, as long as it runs with the system account there are green lights though in the Palo Alto User_ID Agent screen so I will try if I can get a block page when entering corporate credentials.  Still a bit confused how all this works but let's give it a try 🙂   Remko ... View more

Hi, found your post and wondered if you could point me in the right direction.   Trying to implement this as well in our environment.  I have build a RODC and installed both programs  Running PAN-OS version 8.1.7   I am running into some problems though. The User_ID agent runs as a service. At first via the Local System Account but if you configure it to run with a dedicated account it wants to run the service with this account   Although the account is configured to run-as-a-service in the default domain policy it throws in an error when you start the service.   I have used the following instructions to set this up https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/threat-prevention/prevent-credential-phishing/configure-credential-detection-with-the-windows-based-user-id-agent.html#   Are there any additional instructions that I need to follow to implement this correctly on a RODC (Server 2012R2)?   Remko     ... View more

Interresting proposal. Do I understand correctly that you mean this ? https://searchenterprisedesktop.techtarget.com/answer/How-can-IT-put-Windows-10-containers-to-use   First of all I need to familiarize myself on the topic. I have not worked with this at all. Secondly these systems are outside our organization so we do not have any control of these.     I am just trying to understand how this whole single sign on works and why it works differently for each browser.  Easiest is to put a notification on the webpage that it works best with a particular browser but I guess with every IT problem we would like to know what is causing this.    Remko   ... View more

Leo,   We noticed that an upgrade was available of PDQ inventory. After the upgrade (release 3) the virus detections disappeared. I have also informed PDQ/Admin Arsenal about our findings.   Remko ... View more

I started noticing these warnings yesterday. Prior to this, this particular "virus" was not found. The report runs at night for the last 24 hours. Yesterday the count was 1973.  For today (last 24 hours ) the count is 2040   It is hard to tell when exactly a scan is triggered. When the scan is > 7 days old. When a new application is installed a scanned is performed, etc. Strange thing is that is also triggers on URL's I am not sure why I am seeing these messages?       ... View more

Yes we do.    The file (PDQInventoryScanner.exe) as shown in the screenshot is classified as benign. So not sure why it is triggered. In the screenshot  it also shows certain URL's as the same virus.  Most likely the inventory scanner also checks cloud services for things like warrenty, etc. I just do not understand why I have all of a sudden 2.7 K of virusses detected 🙂   I have submitted a case now with the local reseller.    Will keep you posted...     ... View more