About dmilrad

Unit 42 has posted a threat brief detailing the attack, IOC's, and product mitigations.  We will continue to update the brief as we get additional details or expanded product mitigations.  The brief can be found here https://unit42.paloaltonetworks.com/3cxdesktopapp-supply-chain-attack/   ... View more

Take a sneak peek at Cortex Symphony 2021, the premier summit for security operations. Kevin Smith hosts two days of engaging keynotes, breakouts and technical workshops. Don’t miss out! Register now.  https://bit.ly/3rIYrHA ... View more

As a valued member of our Cortex XDR community, we’d greatly appreciate your feedback on the Gartner Peer Insights platform.  You do not need to be a Gartner client to provide a review.    The first 100 respondents will receive a $25 Visa gift card.  The survey should only take 10-12 minutes of your time:  https://gtnr.it/38tvojv ... View more

As part of infrastructure changes made to the Traps management service, we have begun migrating URLs used by Traps agents to communicate with Traps management service in the cloud. Some customers may need to adjust firewall policies to allow outbound traffic to the correct regional Traps instances.   Current Policy For administrators using the SSL Decryption or App-ID features on Palo Alto Networks firewalls, no changes are required. Firewall policy should continue to allow the applications "ssl" and "traps-management-service" for Traps to function.   If you are using SSL Decryption, and are only allowing specific URLs as part of your policy, traffic to the following URLs should be allowed depending on your regional location.   US: https://s3.amazonaws.com/traps-prodng-installers-origin-10 https://traps-prodng-agent-uploads-10.s3.amazonaws.com https://traps-prodng-scanning-results-10.s3.amazonaws.com https://s3.amazonaws.com/traps-prodng-distributions-10   EU: https://s3.eu-central-1.amazonaws.com/traps-prodng-installers-origin-70 https://traps-prodng-scanning-results-70.s3.eu-central-1.amazonaws.com https://traps-prodng-agent-uploads-70.s3.eu-central-1.amazonaws.com https://s3.eu-central-1.amazonaws.com/traps-prodng-distributions-70     Action Required: By May 7 th,  administrators using SSL Decryption and allowing access to specific URLs must add the following URLs to your policy to avoid disrupting agent communication with the Traps management service.   US: https://traps-prodng-distributions-10.s3.amazonaws.com https://traps-prodng-agent-uploads-10.s3.amazonaws.com https://traps-prodng-scanning-results-10.s3.amazonaws.com https://traps-prodng-installers-origin-10.s3.amazonaws.com   EU : https://traps-prodng-distributions-70.s3.eu-central-1.amazonaws.com https://traps-prodng-agent-uploads-70.s3.eu-central-1.amazonaws.com https://traps-prodng-scanning-results-70.s3.eu-central-1.amazonaws.com https://traps-prodng-installers-origin-70.s3.eu-central-1.amazonaws.com   Following the update, customers should allow both the old and new URLs for at least two weeks to allow the changes to propagate to all agents.   Palo Alto Networks will release an update for the ‘traps-management-service’ App-ID prior to the change date. Firewall administrators enabling access to Traps management service via App-ID policy can remove ‘SSL’ from applicable rules once that content version has been applied. No further action required. FAQ   Q: Why is Palo Alto Networks making these changes? A: The previous URL construct linked to an Amazon S3 service in the AWS datacenter . Following the recommended best practices, we are reconstructing the URLs to connect directly to specific Traps S3 buckets, adding an additional layer of security.   Q: Can I expect additional updates to Traps management service traffic? A: No further changes are planned. Additionally, with the changes above, any new URLs needed can be easily added to the service and the App-ID without interaction needed from the firewall administrator.   For more information and detailed configuration instructions, please visit the article below: https://docs.paloaltonetworks.com/traps/tms/traps-management-service-admin/get-started-with-tms/enable-access-tms.html We apologize for any inconvenience this may have caused. Please contact support.paloaltonetworks.com with any further questions.   Thanks, Palo Alto Networks Customer Support ... View more

Read about the changes to Traps role and access controls. These changes that have been implemented on how and where you create, define, and manage roles. Learn what's new, what's changing, and how it will affect your visibility with roles. Got Questions? Get Answers on Live Community.   Please be aware that changes on where and how you create, define, and manage Traps roles have changed.     Currently, roles and access rights are managed from both the Customer Support Portal (CSP) and the Traps management service interface. Beginning in April, these options will be moved to a central location on the hub (formerly Cortex hub). This enhancement will simplify how administrators apply role-based access control for apps and services, and it will allow us to easily scale RBAC to future Cortex offerings.   Additional technical documentation will be available when the feature is released, but please ensure that your Traps administrators are aware of this important change, as soon as possible.   Once this feature is launched, service roles from the CSP and the roles from Traps management service will no longer be available, and the Permissions tab within Traps management service will be removed. Instead, administrators will go to the new hub Role Assignment page to perform role management.    Furthermore, Traps management service offers the ability to assign granular roles (i.e., Traps specific roles) via the Traps management console. As part of this launch, those roles will move over and be made available via the hub.    NOTE: All previously defined Traps granular roles and permissions will be migrated to the new Role Assignment page and will be available on there.   With the new RBAC, there are also three new roles that provide super-user privileges that vary in scope. The first person in the organization to register with Palo Alto Networks Customer Support Portal is the Account Administrator. The Account Administrator role gives the user full access to all instances of all apps activated for your organization. Users assigned as Super Admin from the Customer Support Portal prior to April 2019 are automatically assigned the Account Administrator role in the hub.   If you are the Account Administrator, you can give another user the Account Administrator role. Users with this role can grant other users the App Administrator role, which allows users to activate, deactivate, and manage individual app instances.   To limit a user’s access to a specific instance, you can assign users the Instance Administrator role, which enables the user to access only the app instance for which the role is assigned. Users that are assigned any of these roles can also grant more granular roles for Traps management service. By default, all new users are assigned No Role.   To ensure a smooth transition, we want to ensure that you are aware of these changes to Traps management service, the hub, and Customer Support Portal.                                                   Terminology Change Palo Alto Networks Application Framework properties changed names in February 2019. The remainder of this topic will use the new product names identified in the following table:                         Role Management Changes Prior to March 2019, you managed all roles in the Customer Support Portal. Now, you manage roles specific to Cortex apps and other properties in the hub. All other role management remains in the Customer Support Portal. Where you previously had a role that was specific to an app (e.g., the Magnifier role), you now have a single role (Instance Administrator) that is granted to a user for a specific app. If no other roles are available for an app, then this is the only available role.   Some apps, such as Traps, implement a constellation of roles that you can grant to a user. These roles are managed in the hub, but you should refer to the product documentation for the app in order to obtain details on these custom roles.  When Palo Alto Networks migrated role management from the Customer Support Portal roles to the hub, existing users received the following roles:                                   Next Steps If you are starting or in the process of a Proof of Concept, please ensure any other administrators are aware of the changes. If you are actively using Traps management service, please make sure you are familiar with the changes to avoid any disruption or confusion with the changes. Traps documentation will be updated when the feature is pushed live.      For more details and instructions, please visit the Traps page on TechDocs..     NOTE: Cortex Hub has been changed to "hub." ... View more

See what's new in Traps 6.0 and how these newly released features can help improve your security posture. New updates include Behavioral Threat Protection, Rich Data Collection for Cortex XDR, Response Actions, Traps for Linux Containers, and Malware Protection for Linux. Get your questions answered in the Live Community.     Introducing Traps 6.0 Traps has continually focused on protecting endpoints by looking at the behavior and techniques of threats used to attack and compromise endpoints. We have continued that theme in Traps releases over the past two years.   By introducing features such as the Kernel exploit prevention module, Child Process Protection module, and the ransomware protection module, Traps has been able to increase its prevention-first position. These features have helped stave off attacks from threats like WannaCry, Petya, NotPetya and many more without the need for signatures or prior knowledge of the threat.   As the threat landscape continues to evolve, we are seeing attacks become more sophisticated and evasive by leveraging OS capabilities and administrative tools, making these attacks difficult to detect and identify. The latest release of Traps extends the protection capabilities to protect endpoints across the most complete spectrum of threats. Below are highlights of these new features.    Features Introduced in Traps 6.0  Behavioral Threat Protection detects and stops attack activity by monitoring for malicious sequences across processes and terminating attacks when detected. When Traps detects these malicious events, it will present the timeline of actions taken in the event analysis tab in the Traps management console (See Figure 1).   Figure 1: Behavioral Threat Protection Analysis from the Traps console   Rich Data Collection for Cortex XDR™  To accelerate threat investigation and incident response, Traps can now collect detailed information about all active process, network, file, and registry activity on an endpoint. From the Cortex XDR app, you can view the activity details collected by Traps to understand the event context and gain insight on the event scope (See Figure 2). This includes all activities that took place during an attack, the endpoints that were involved and the damage.    Figure 2: Cortex XDR Causality Chain view   Response Actions Traps uses the Cortex Data Lake to store all event and incident data captured, allowing a clean handoff to Cortex XDR for further investigation and incident response. Cortex XDR cloud-based detection and response is an app that empowers SecOps to stop sophisticated attacks and adapt defenses in real time. By combining rich network, endpoint and cloud data with analytics, Cortex XDR detects highly evasive attacks. Following an investigation, when remediation on the endpoint is needed, administrators have the option to do the following: Terminate processes to stop any running malware from continuing to perform malicious activity on the endpoint. Isolate endpoints by halting all network access on compromised endpoints except for traffic to Traps management service, which prevents them from communicating with and potentially infecting other endpoints. Quarantine malicious files and remove them from their working directories if Traps has not already quarantined the files. Block additional executions of a given file by blacklisting it in the policy.   Traps for Linux Containers Traps now extends Linux exploit and malware protection to processes that run in Linux containers. When you install Traps on a Linux server, Traps automatically protects any new and existing containerized processes regardless of the container solution (e.g., docker). Because the Traps management service issues the license per Linux server, each container does not consume any additional licenses (See Figure 3). For more information on Traps for Linux, see TRAPS AGENT 6.0 FOR LINUX.     Figure 3: Traps Linux Container Protection   Malware Protection for Linux Traps can now prevent known and unknown malware from running on Linux servers by leveraging WildFire threat intelligence and local analysis to analyze ELF files. When an ELF file is executed on the host server or within a container on the Traps-protected-host, Traps automatically suspends the execution until a WildFire or local analysis verdict is obtained. When the verdict is malware, Traps prevents the process execution and reports the event to the Traps management service. If the ELF file is unknown to WildFire, Traps can also upload it to WildFire for further analysis. The number of malicious ELF files submitted to WildFire continues to grow as seen by the AutoFocus report below (See Figure 4).   Figure 4: AutoFocus Report on Malicious ELF files See also: For more information on these and other new features in Traps 6.0, please visit the Traps Documentation Page   Thanks for reading our blogs! Don't forget to Like (Thumbs Up) if you like this content, and, as always, we welcome all comments and questions below in the Comments section. ... View more

Every month new features are introduced into the Traps management service.  To help you stay up to date we will post these new features here.  For more information click the link below to go to Traps technical documentation.     1. Role-based Access Controls:  The following predefined roles provide access to the Traps management service to users based on their role and responsibilities. Super Admin – Full access with the ability to perform any action in the system such as create policies and assign subordinate roles. Security Admin – Create and modify security policies and review security events. IT Admin –  Create and modify endpoint groups and prepare agents to be deployed.  Read Only –  Can view information in the Traps console. User cannot make any changes to the policies or settings. No Access – This setting is used if you have multiple Traps management service tenants with different administrators for each tenant and want to restrict cross tenant access.   2. On-Screen “What’s New” Notification:  On-screen display appears when new features are available with links for more details. Traps Management New Release Notification   3. Administrative Action Tracking:   Allows admins to monitor the status of agent actions (upgrades, scans, and other activity) across multiple endpoints. Example of TRAPS Administrative Action Tracking     4. DLL Blacklist for Exploit Protection:   A blacklist can now be created as part of an Exploit Security Profile  to prevent DLLs from running when launched by protected processes.   5. Examination of Office Files on Network Drives:   Allows Traps to scan Microsoft Office files for malicious macros when the file is run from a network drive. Examine Office Files from Network Drives   6. Enhanced Management for Resolved Events:   Allows you to close out one or more events without deleting them from the Traps management service.    7. Bulk Security Event Status Management:   Simplifies management of multiple security events in bulk. For example, following an investigation on multiple endpoints you can change the status in one action.   For more details on the new features, please refer to the following resources: Traps Management Service Release Notes ... View more