synoti logosynoti logo
Palo Alto

Detection rules for Palo Alto Data sources. Every rule contains its MITRE ATT&CK mapping, an impact rating, and details on what it identifies.

This category lists 7 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
IOC Match from Threat Intelligence FeedDefense EvasionT1027 - Obfuscated Files or InformationC:3 / I:3 / A:2
PAN-OS DNS Security Alert DetectionCommand and ControlT1071.004 - Application Layer Protocol: DNSC:3 / I:2 / A:1
PAN-OS Malicious URL Category BlockCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:2 / A:1
PAN-OS Management Plane Login Brute ForceCredential AccessT1110 - Brute ForceC:3 / I:3 / A:1
PAN-OS Spyware and Vulnerability Threat DetectionIntrusion DetectionT1190 - Exploit Public-Facing ApplicationC:3 / I:3 / A:2
WildFire Malware DetectionExecutionT1204.002 - User Execution: Malicious FileC:3 / I:3 / A:2
Zero-Day Exploit PreventionExecutionT1203 - Exploitation for Client ExecutionC:3 / I:3 / A:3

Rule Example

Below is an example of a rule definition for IOC Match from Threat Intelligence Feed (view in repository):

# Rule version v1.0.0

dataTypes:
  - firewall-paloalto
name: IOC Match from Threat Intelligence Feed
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Defense Evasion
technique: "T1027 - Obfuscated Files or Information"
adversary: origin
references:
  - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/threat-intelligence-management
  - https://attack.mitre.org/techniques/T1027/
description: |
  Detects when network traffic matches known Indicators of Compromise (IOCs) from threat intelligence feeds. This includes malicious IPs, domains, URLs, or file hashes associated with known threat actors or campaigns. The Palo Alto firewall has identified and blocked traffic based on threat intelligence data.

  Next Steps:
  1. Review the specific IOC that triggered the alert and verify its legitimacy
  2. Investigate the source IP address for additional suspicious activities
  3. Check if the same IOC has been observed from other internal hosts
  4. Examine the target destination for potential compromise indicators
  5. Update threat intelligence feeds and firewall rules as necessary
  6. Consider isolating affected hosts if compromise is confirmed
  7. Document the incident and IOC details for threat hunting activities
where: |
  (contains("log.panOSThreatCategory", "malware") ||
   contains("log.panOSThreatCategory", "command-and-control") ||
   contains("log.panOSThreatCategory", "phishing") ||
   contains("log.panOSThreatCategory", "botnet") ||
   contains("log.msg", "threat-intel") ||
   contains("log.msg", "ioc-match")) &&
  oneOf("log.panOSAction", ["block", "deny", "drop", "reset-both", "reset-client", "reset-server"])
groupBy:
  - lastEvent.log.panOSThreatID
  - adversary.ip
  - target.ip

Rule Details

IOC Match from Threat Intelligence Feed

Identifies network traffic that aligns with known Indicators of Compromise (IOCs) sourced from threat intelligence feeds. These IOCs cover malicious IPs, domains, URLs, or file hashes linked to recognized threat actors or campaigns. Based on threat intelligence data, the Palo Alto firewall has detected and prevented such traffic.

PAN-OS DNS Security Alert Detection

Identifies PAN-OS DNS Security alerts, such as DNS sinkholing, domain generation algorithm (DGA) detection, DNS tunneling, and lookups of known malicious domains. Such alerts can signal possible C2 communication or data exfiltration over DNS.

PAN-OS Malicious URL Category Block

Identifies URL filtering blocks on Palo Alto firewalls for malicious, phishing, or command-and-control URL categories. When the same host is blocked repeatedly, this may point to malware infection or compromised credentials.

PAN-OS Management Plane Login Brute Force

Identifies repeated failed login attempts to the PAN-OS management plane (web UI, SSH, or API), which indicate possible brute force attacks targeting firewall administrative credentials.

PAN-OS Spyware and Vulnerability Threat Detection

Identifies spyware and vulnerability threat detections generated by the PAN-OS threat prevention engine. Such alerts point to active exploitation attempts, spyware callbacks, or exploitation of known vulnerabilities against protected hosts.

WildFire Malware Detection

Identifies when WildFire classifies files or malware as malicious based on threat analysis. This rule fires on files with malicious verdicts from WildFire's advanced analysis engine, which can signal possible malware execution or file-based threats.

Zero-Day Exploit Prevention

Identifies possible zero-day exploits that Palo Alto's threat prevention engine has blocked. This rule fires on high-severity vulnerability attempts and unknown threat patterns that could indicate zero-day exploit attempts. The rule searches for THREAT type events with vulnerability or exploit subtypes at high or critical severity that either include CVE references or are classified as unknown threats.