About Nicka

We have been slammed with random Chinese IP addresses attemping to brute-force accounts via SMTP.  Amusingly enough, our gateway doesn't even support that feature but the amount of traffic attempting it is consuming all available ports.   I was able to make a signature to catch it when the server responds back with a "502 Unsupported" command but the problem is this alone makes Palo Alto think the attacker is always the server and not the client.  So I need to add something to detect the client's traffic first...   The clients are sending an "AUTH LOGIN" command.  I can create a rule to detect the AUTH part but the string for "LOGIN" has to be at least 7 characters, which is impossible to meet those requirements.  I then tried to create a negate rule but that didn't work and it wouldn't detect the rule at all.  So any ideas how to get this to work?   For the time being I just created a DOS resource policy to only allow 5 concurrent source-IP connections.  It works but I'd rather have a rule to actually block-IP the attacker for 30 minutes then just let them continue attacking us.   I contacted support and they redirected my case to the threat team.  The threat team then sent me here saying they do not offer help on custom signatures and to post any questions in the forums...   ... View more