L7 Threat Log filter 2020/03/30

( name-of-threatid eq 'Mirai.Gen Command And Control Traffic' ) OR ( name-of-threatid eq 'Gafgyt.Gen Command And Control Traffic' ) OR
( name-of-threatid eq 'ZeroAccess.Gen Command and Control Traffic' ) OR ( name-of-threatid eq 'NJRat.Gen Command and Control Traffic' ) OR
( name-of-threatid eq 'SIPVicious Scanner Detection' ) OR ( name-of-threatid eq 'Metasploit VxWorks WDB Agent Scanner Detection' ) OR
( name-of-threatid eq 'Backdoor.gafgyt:switchnets.net' ) OR
( name-of-threatid eq 'Multiple CCTV-DVR Remote Command Injection Vulnerability' ) OR
( name-of-threatid eq 'TVT-Digital CCTV-DVR Remote Code Execution Vulnerability' ) OR
( name-of-threatid eq 'Netis/Netcore Router Default Credential Remote Code Execution Vulnerability' ) OR
( name-of-threatid eq 'RPC Portmapper DUMP Request Detected' ) OR
( name-of-threatid eq 'NTP Amplification REQ_MON_GETLIST Request Found' ) OR
( name-of-threatid eq 'NTP Amplification Denial-Of-Service Attack' )

Threat List from 2020/03/28 - 2020/03/30

Top 20 Threats

Top 100 Threats

---------------------------

NTP Amplification REQ_MON_GETLIST Request Found

NTP Amplification Denial-Of-Service Attack

Non-RFC Compliant DNS Traffic on Port 53/5353

Suspicious TLS Evasion Found

Telnet Authentication Failed

Windows SMB Login Attempt

Suspicious HTTP Evasion Found

MSSQL DB Login Authentication Failed

MSSQL Login failed for user 'sa' execution

SMB: User Password Brute Force Attempt

Telnet Authentication Brute Force Attempt

Microsoft SQL Server User Authentication Brute Force Attempt

Virus.mirai:ciqrgscslt.hopto.org

SIPVicious Scanner Detection

Microsoft Windows SMB Negotiate Request

Non-RFC Compliant TELNET Traffic on Port 23

Non-RFC Compliant FTP Traffic on Port 21

DNS ANY Request

Non-RFC Compliant DNS Traffic on Port 53/5353

NetBIOS null session

HTTP Non-RFC Compliant Request

Non-RFC Compliant HTTP Traffic on Port 80

Abnormal SSL traffic on port 443

Mirai.Gen Command And Control Traffic

Gafgyt.Gen Command And Control Traffic

Non-RFC Compliant SSL Traffic on Port 443

Non-RFC Compliant DNS Traffic on Port 53/5353

HTTP Unauthorized Error

POODLE Bites Vulnerability

Netis/Netcore Router Default Credential Remote Code Execution Vulnerability

Microsoft Communicator INVITE Flood Denial of Service Vulnerability

Suspicious HTTP Response Found

Non-RFC Compliant DNS Traffic on Port 53/5353

RPC Portmapper DUMP Request Detected

SSH2 Login Attempt

HTTP Non RFC-Compliant Response Found

SIP Register Request Attempt

HTTP WWW-Authentication Failed

Non-RFC Compliant TELNET Traffic on Port 23

Suspicious or malformed HTTP Referer field

HTTP Unauthorized Brute Force Attack

DNS ANY Queries Brute Force DOS Attack

Use of insecure SSLv3.0 Found in Server Response

JavaScript Obfuscation Detected

SIP Invalid Sent-by Address Found

Suspicious JavaScript Evasion Detected

Suspicious DNS Query (Virus.virut:formatmcl.gicp.net)

PHP DIESCAN Information Disclosure Vulnerability

Suspicious DNS Query (Virus.virut:formatmcl.gicp.net)

NetBIOS nbtstat query

GTPv1 Echo Request Message

Metasploit VxWorks WDB Agent Scanner Detection

Non-RFC Compliant TFTP Traffic on Port 69

Non-RFC Compliant HTTP Traffic on Port 80

DDoS.nitol:iamnull.no-ip.org

Malware.mdrop:xmr.pool.minergate.com

DNS Long qname Detection

JavaScript Obfuscation Detected

Non-RFC Compliant HTTP Traffic on Port 80

JavaScript Obfuscation Detected

HTTP: User Authentication Brute Force Attempt

dropper.Gen Command And Control Traffic

Non-RFC Compliant MS-DS-SMB Traffic on Port 445

Non-RFC Compliant MS-DS-SMB Traffic on Port 445

IP Address Disclosure Detection

SIP Malformed Request: Unknown URI Schemes in Header Fields

Non-RFC Compliant HTTP Traffic on Port 80

Non-RFC Compliant NTP Traffic on Port 123

SSH User Authentication Brute Force Attempt

HTTP OPTIONS Method

Backdoor.gafgyt:switchnets.net

Non-RFC Compliant MS-DS-SMB Traffic on Port 445

Non-RFC Compliant MS-DS-SMB Traffic on Port 445

ASUS/Netcore Router Default Credential Remote Code Execution Vulnerability

JavaScript Obfuscation Detected

Non-RFC Compliant HTTP Traffic on Port 80

Suspicious DNS Query (Virus.sality:alain.forgeot.free.fr)

SIP Register Message Brute Force Attack

TrojanDropper.delfsnif:0x0ss.sytes.net

XMRig Miner Command and Control Traffic Detection

Morto RDP Request Traffic

SSH2 Failed Login Attempt

Non-RFC Compliant SMTP Traffic on Port 25

Bifrose Command And Control Traffic

generic:bt.7081.com

generic:download.zzb5.cn

Non-RFC Compliant HTTP Traffic on Port 80

Failed Authentication Through Mail Protocol

Suspicious File Downloading Detection

Non-RFC Compliant DNS Traffic on Port 53/5353

flystudio.buqi C2 traffic

generic:deepsecu.com

Suspicious DNS Query (trojan.softcnapp:i.fahpvdxw.cn)

VBScript Obfuscation

Avtech Devices Unauthenticated Command Injection Vulnerability

Multiple CCTV-DVR Remote Command Injection Vulnerability

Ncrack RDP scan

Microsoft Windows SMB Remote Code Execution Vulnerability

generic:transmapp.com

PaloAlto Firewall Threat Log Fields

Format

: FUTURE_USE, Receive Time, Serial Number, Type, Subtype, FUTURE_USE, Generated Time, Source IP, Destination IP, NAT Source IP, NAT Destination IP, Rule Name, Source User, Destination User, Application, Virtual System, Source Zone, Destination Zone, Ingress Interface, Egress Interface, Log Forwarding Profile, FUTURE_USE, Session ID, Repeat Count, Source Port, Destination Port, NAT Source Port, NAT Destination Port, Flags, Protocol, Action, Miscellaneous, Threat ID, Category, Severity, Direction, Sequence Number, Action Flags, Source Location, Destination Location, FUTURE_USE, Content Type, PCAP_id, Filedigest, Cloud, URL Index, User Agent, File Type, X-Forwarded-For, Referer, Sender, Subject, Recipient, Report ID, Device Group Hierarchy Level 1, Device Group Hierarchy Level 2, Device Group Hierarchy Level 3, Device Group Hierarchy Level 4, Virtual System Name, Device Name, FUTURE_USE,

FIELD NAME	DESCRIPTION
Receive Time (receive_time)	Time the log was received at the management plane.
Serial Number (serial)	Serial number of the firewall that generated the log.
Type (type)	Specifies the type of log; value is THREAT.
Subtype (subtype)	Subtype of threat log. Values include the following: data—Data pattern matching a Data Filtering profile. file—File type matching a File Blocking profile. flood—Flood detected via a Zone Protection profile. packet—Packet-based attack protection triggered by a Zone Protection profile. scan—Scan detected via a Zone Protection profile. spyware —Spyware detected via an Anti-Spyware profile. url—URL filtering log. virus—Virus detected via an Antivirus profile. vulnerability —Vulnerability exploit detected via a Vulnerability Protection profile. wildfire —A WildFire verdict generated when the firewall submits a file to WildFire per a WildFire Analysis profile and a verdict (malicious, grayware, or benign, depending on what you are logging) is logged in the WildFire Submissions log. wildfire-virus—Virus detected via an Antivirus profile.
Generated Time (time_generated)	Time the log was generated on the dataplane.
Source IP (src)	Original session source IP address.
Destination IP (dst)	Original session destination IP address.
NAT Source IP (natsrc)	If source NAT performed, the post-NAT source IP address.
NAT Destination IP (natdst)	If destination NAT performed, the post-NAT destination IP address.
Rule Name (rule)	Name of the rule that the session matched.
Source User (srcuser)	Username of the user who initiated the session.
Destination User (dstuser)	Username of the user to which the session was destined.
Application (app)	Application associated with the session.
Virtual System (vsys)	Virtual System associated with the session.
Source Zone (from)	Zone the session was sourced from.
Destination Zone (to)	Zone the session was destined to.
Ingress Interface (inbound_if)	Interface that the session was sourced from.
Egress Interface (outbound_if)	Interface that the session was destined to.
Log Forwarding Profile (logset)	Log Forwarding Profile that was applied to the session.
Session ID (sessionid)	An internal numerical identifier applied to each session.
Repeat Count (repeatcnt)	Number of sessions with same Source IP, Destination IP, Application, and Subtype seen within 5 seconds; used for ICMP only.
Source Port (sport)	Source port utilized by the session.
Destination Port (dport)	Destination port utilized by the session.
NAT Source Port (natsport)	Post-NAT source port.
NAT Destination Port (natdport)	Post-NAT destination port.
Flags (flags)	32-bit field that provides details on session; this field can be decoded by AND-ing the values with the logged value: 0x80000000 —session has a packet capture (PCAP) 0x02000000 —IPv6 session 0x01000000 —SSL session was decrypted (SSL Proxy) 0x00800000 —session was denied via URL filtering 0x00400000 —session has a NAT translation performed (NAT) 0x00200000 —user information for the session was captured via the captive portal (Captive Portal) 0x00080000 —X-Forwarded-For value from a proxy is in the source user field 0x00040000 —log corresponds to a transaction within a http proxy session (Proxy Transaction) 0x00008000 —session is a container page access (Container Page) 0x00002000 —session has a temporary match on a rule for implicit application dependency handling. Available in PAN-OS 5.0.0 and above 0x00000800 —symmetric return was used to forward traffic for this session
Protocol (proto)	IP protocol associated with the session.
Action (action)	Action taken for the session; values are alert, allow, deny, drop, drop-all-packets, reset-client, reset-server, reset-both, block-url. alert—threat or URL detected but not blocked allow— flood detection alert deny—file is blocked drop— threat detected and associated session was dropped reset-client —threat detected and a TCP RST is sent to the client reset-server —threat detected and a TCP RST is sent to the server reset-both —threat detected and a TCP RST is sent to both the client and the server block-url —URL request was blocked because it matched a URL category that was set to be blocked block-ip—threat detected and client IP is blocked random-drop—flood detected and packet was randomly dropped sinkhole—DNS sinkhole activated syncookie-sent—syncookie alert block-continue (URL subtype only)—a HTTP request is blocked and redirected to a Continue page with a button for confirmation to proceed continue (URL subtype only)—response to a block-continue URL continue page indicating a block-continue request was allowed to proceed block-override (URL subtype only)—a HTTP request is blocked and redirected to an Admin override page that requires a pass code from the firewall administrator to continue override-lockout (URL subtype only)—too many failed admin override pass code attempts from the source IP and is now blocked from the block-override redirect page override (URL subtype only)—response to a block-override page where a correct pass code is provided and the request is allowed
Miscellaneous (misc)	Field with variable length with a maximum of 63 characters. A Filename has a maximum of 63 characters. A URL has a maximum of 1023 characters The actual URI when the subtype is url File name or file type when the subtype is file File name when the subtype is virus File name when the subtype is wildfire-virus File name when the subtype is wildfire URL or File name when the subtype is vulnerability if applicable
Threat ID (threatid)	Palo Alto Networks identifier for the threat. It is a description string followed by a 64-bit numerical identifier in parentheses for some Subtypes: 8000 – 8099— scan detection 8500 – 8599— flood detection 9999— URL filtering log 10000 – 19999 —spyware phone home detection 20000 – 29999 —spyware download detection 30000 – 44999 —vulnerability exploit detection 52000 – 52999— filetype detection 60000 – 69999 —data filtering detection 100000 – 2999999 —virus detection 3000000 – 3999999 —WildFire signature feed 4000000-4999999 —DNS Botnet signatures
Category (category)	For URL Subtype, it is the URL Category; For WildFire subtype, it is the verdict on the file and is either ‘malicious’, ‘grayware’, or ‘benign’; For other subtypes, the value is ‘any’.
Severity (severity)	Severity associated with the threat; values are informational, low, medium, high, critical.
Direction (direction)	Indicates the direction of the attack, client-to-server or server-to-client: 0—direction of the threat is client to server 1—direction of the threat is server to client
Sequence Number (seqno)	A 64-bit log entry identifier incremented sequentially. Each log type has a unique number space. This field is not supported on PA-7000 Series firewalls.
Action Flags (actionflags)	A bit field indicating if the log was forwarded to Panorama.
Source Location (srcloc)	Source country or Internal region for private addresses. Maximum length is 32 bytes.
Destination Location (dstloc)	Destination country or Internal region for private addresses. Maximum length is 32 bytes.
Content Type (contenttype)�	Applicable only when Subtype is URL. Content type of the HTTP response data. Maximum length 32 bytes.
PCAP ID� (pcap_id)�	The packet capture (pcap) ID is a 64 bit unsigned integral denoting an ID to correlate threat pcap files with extended pcaps taken as a part of that flow. All threat logs will contain either a pcap_id of 0 (no associated pcap), or an ID referencing the extended pcap file.
File Digest� (filedigest)�	Only for WildFire subtype; all other types do not use this field The filedigest string shows the binary hash of the file sent to be analyzed by the WildFire service.
Cloud� (cloud)	Only for WildFire subtype; all other types do not use this field. The cloud string displays the FQDN of either the WildFire appliance (private) or the WildFire cloud (public) from where the file was uploaded for analysis.
URL Index (url_idx)	Used in URL Filtering and WildFire subtypes. When an application uses TCP keepalives to keep a connection open for a length of time, all the log entries for that session have a single session ID. In such cases, when you have a single threat log (and session ID) that includes multiple URL entries, the url_idx is a counter that allows you to correlate the order of each log entry within the single session. For example, to learn the URL of a file that the firewall forwarded to WildFire for analysis, locate the session ID and the url_idx from the WildFire Submissions log and search for the same session ID and url_idx in your URL filtering logs. The log entry that matches the session ID and url_idx will contain the URL of the file that was forwarded to WildFire.
User Agent (user_agent)	Only for the URL Filtering subtype; all other types do not use this field. The User Agent field specifies the web browser that the user used to access the URL, for example Internet Explorer. This information is sent in the HTTP request to the server.
File Type (filetype)	Only for WildFire subtype; all other types do not use this field. Specifies the type of file that the firewall forwarded for WildFire analysis.
X-Forwarded-For (xff)	Only for the URL Filtering subtype; all other types do not use this field. The X-Forwarded-For field in the HTTP header contains the IP address of the user who requested the web page. It allows you to identify the IP address of the user, which is useful particularly if you have a proxy server on your network that replaces the user IP address with its own address in the source IP address field of the packet header.
Referer (referer)	Only for the URL Filtering subtype; all other types do not use this field. The Referer field in the HTTP header contains the URL of the web page that linked the user to another web page; it is the source that redirected (referred) the user to the web page that is being requested.
Sender (sender)	Only for WildFire subtype; all other types do not use this field. Specifies the name of the sender of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
Subject (subject)	Only for WildFire subtype; all other types do not use this field. Specifies the subject of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
Recipient (recipient)	Only for WildFire subtype; all other types do not use this field. Specifies the name of the receiver of an email that WildFire determined to be malicious when analyzing an email link forwarded by the firewall.
Report ID (reportid)	Only for WildFire subtype; all other types do not use this field. Identifies the analysis request on the WildFire cloud or the WildFire appliance.
Device Group Hierarchy (dg_hier_level_1 to dg_hier_level_4)	A sequence of identification numbers that indicate the device group’s location within a device group hierarchy. The firewall (or virtual system) generating the log includes the identification number of each ancestor in its device group hierarchy. The shared device group (level 0) is not included in this structure. If the log values are 12, 34, 45, 0, it means that the log was generated by a firewall (or virtual system) that belongs to device group 45, and its ancestors are 34, and 12. To view the device group names that correspond to the value 12, 34 or 45, use one of the following methods: API query:  /api/?type=op&cmd=<show><dg-hierarchy></dg-hierarchy></show>
Virtual System Name (vsys_name)	The name of the virtual system associated with the session; only valid on firewalls enabled for multiple virtual systems.
Device Name (device_name)	The hostname of the firewall on which the session was logged.

Type of threat Intelligence

1. Strategic
1. High-Level information on changing risks.
2. Consumed by High-Level Executives and Management.
2. Operational
1. Information on specific incoming attack
2. Consumed by Security Manager, Network Defenders.
3. Tactical
1. Information on attacker's tactics, techniques (TTPs).
2. Consumed by IT Service and SOC Managers, Administrators.
4. Technical
1. Information on specific indicators of compromise.
2. Consumed by SOC Staff, IR Teams.

• Strategic
• Strategic threat intelligence provides high-level information regarding cyber security posture, threats and its impact on business 
• It is consumed by high-level executives and management of the organization. 
• It is collected from sources such as OSINT, CTI vendors, and ISAO/ISACs. 
• It is generally in the form of a report that mainly focuses on high-level business strategies. 
• It is used by the management to take strategic business decisions and to analyze the effect of such decisions.

• Tactical
• Tactical threat intelligence provides information related to TTPs used by threat actors (attackers) to perform attacks. 
• It is consumed by cyber security professionals such as IT service managers, security operations managers, administrators, and architects. 
• The collection sources for tactical threat intelligence include campaign reports, malware, incident reports, attack group reports, and human intelligence. 
• It is generated in the form of a forensic report that includes highly technical information such as malware, campaigns, techniques, and tools 
• It helps the cyber security professionals to understand how the adversaries are expected to perform the attack on the organization, the technical capabilities and goals of the adversaries along with their attack vectors

• Operational

• Operational threat intelligence provides information about specific threats against the organization. 
• It is consumed by security managers or heads of incident response, network defenders, security forensics, and fraud detection teams. 
• It is collected from sources such as humans, social media, and chat rooms. 
• It is generally in the form of a report that contains identified malicious activities, recommended courses of action, and warnings of emerging attacks. 
• It helps organizations to understand the possible threat actors along with their intention, capability, and opportunity to attack, vulnerable IT assets, and the impact of the attack if it is successful. 
• It helps IR and forensics teams in deploying security assets with the aim of identifying and stopping upcoming attacks, improving the capability of detecting attacks at an early stage, and reducing its damage on IT assets

• Technical
• Technical threat intelligence provides information about an attacker's resources such as command and control channels and tools, used to perform the attack 
• It is consumed by security operations center (SOC) staff and IR teams. 
• It has a shorter lifespan compared to tactical threat intelligence and mainly focuses on a specific indicator of compromise. 
• The indicators of technical threat intelligence are collected from active campaigns, attacks that are performed on other organizations or data feeds provided by external third-parties 
• Examples of technical threat intelligence include specific IP addresses and domains used by malicious endpoints, phishing email headers, hash checksums of malware, etc. 
• It improves detection mechanism by adding identified indicators to the defensive systems such as IDS/IPS, firewalls, endpoint security systems, etc.

脅威情報の種類

1. 戦略的
1. 変化するリスクに関する高レベルの情報。
2. 上級管理職および経営陣により消費されます。
2. 運用中
1. 特定の着信攻撃に関する情報
2. Network DefendersのSecurity Managerによって消費されます。
3. 戦術
1. 攻撃者の戦術、技術（TTP）に関する情報。
2. ITサービスおよびSOCマネージャー、管理者によって消費されます。
4. テクニカル
1. 侵害の特定の指標に関する情報。
2. SOCチーム、IRチームによって消費されます。