Palo Alto Networks

Search Palo Alto Networks rules.

Telemetry Evidence

These values show how indexed rules identify Palo Alto Networks telemetry.

Elastic

Index logs-panw.panos* (14 rules)
Index logs-panw.panos-* (1 rule)
Integration panw (20 rules)

Kusto

Queried source table CommonSecurityLog (9 rules)
Queried source table PaloAltoCDLEvent (10 rules)
Queried source table PaloAltoCortexXDR_Incidents (3 rules)
Queried source table PaloAltoPrismaCloud (11 rules)
Queried source table ThreatIntelIndicators (3 rules)
Queried source table ThreatIntelligenceIndicator (3 rules)
Query discriminator DeviceVendor = Palo Alto Networks (9 rules)
Source collection PaloAlto-PAN-OS (2 rules)

Sigma

Log-source product paloalto (2 rules)

Splunk

Data source Palo Alto Network Threat (9 rules)
Data source Palo Alto Network Traffic (4 rules)

Detection Rules

Elastic #

Abnormally Large DNS Response source medium: Specially crafted DNS requests can manipulate a known overflow vulnerability in some Windows DNS servers, resulting in Remote Code Execution (RCE) or a Denial of Service (DoS) from crashing the service.T1210, T1499, T1499.004
Accepted Default Telnet Port Connection source medium: This rule detects network events that may indicate the use of Telnet traffic. Telnet is commonly used by system administrators to remotely control older or embedded systems using the command line shell. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector. As a plain-text protocol, it may also expose usernames and passwords to anyone capable of observing the traffic.T1021, T1071, T1133, T1190
Elastic Defend and Network Security Alerts Correlation source high: This rule correlate any Elastic Defend alert with a set of suspicious events from Network security devices like Palo Alto Networks (PANW) and Fortinet Fortigate by host.ip and source.ip. This may indicate that this host is compromised and triggering multi-datasource alerts.
Newly Observed IPSEC NAT Traversal Peer source low: This rule identifies outbound IPSEC NAT Traversal (NAT-T) traffic to an external destination IP that was not observed during the previous 5 days. IPSEC is a VPN technology that allows one system to talk to another using encrypted tunnels. NAT Traversal encapsulates IPSEC ESP traffic in UDP and, once a NAT device is detected, both peers float to UDP port 4500 for the tunnel data channel. Newly observed external NAT-T peers may indicate unauthorized VPN use or an adversary tunneling command and control or exfiltration traffic over the Internet.T1095, T1572, T1573
Newly Observed Palo Alto Network Alert source critical: This rule detects Palo Alto Network alerts that are observed for the first time in the previous 5 days of alert history. Analysts can use this to prioritize triage and response.
PANW and Elastic Defend - Command and Control Correlation source medium: This detection correlates Palo Alto Networks (PANW) command and control events with Elastic Defend network events to identify the source process performing the network activity.T1071
Possible FIN7 DGA Command and Control Behavior source high: This rule detects a known command and control pattern in network events. The FIN7 threat group is known to use this command and control technique, while maintaining persistence in their target's network.T1071, T1071.001, T1568, T1568.002
Potential Network Scan Detected source low: This rule identifies a potential port scan from an internal IP address. A port scan is a method utilized by attackers to systematically scan a target system for open ports, allowing them to identify available services and potential vulnerabilities. By mapping out the open ports, attackers can gather critical information to plan and execute targeted attacks, gaining unauthorized access, compromising security, and potentially leading to data breaches, unauthorized control, or further exploitation of the targeted system. This rule defines a threshold-based approach to detect connection attempts from a single internal source to a wide range of destination ports on a single destination.T1046, T1595, T1595.001
Potential Network Sweep Detected source low: This rule identifies a potential network sweep. A network sweep is a method used by attackers to scan a target network, identifying active hosts, open ports, and available services to gather information on vulnerabilities and weaknesses. This reconnaissance helps them plan subsequent attacks and exploit potential entry points for unauthorized access, data theft, or other malicious activities. This rule defines a threshold-based approach to detect multiple connection attempts from a single host to numerous destination hosts over commonly used network services.T1018, T1046, T1595, T1595.001
Potential SYN-Based Port Scan Detected source low: This rule identifies a potential SYN-Based port scan. A SYN port scan is a technique employed by attackers to scan a target network for open ports by sending SYN packets to multiple ports and observing the response. Attackers use this method to identify potential entry points or services that may be vulnerable to exploitation, allowing them to launch targeted attacks or gain unauthorized access to the system or network, compromising its security and potentially leading to data breaches or further malicious activities. This rule defines a threshold-based approach to detect connection attempts from a single source to a large number of unique destination ports, while limiting the number of packets per port.T1046, T1595, T1595.001

Show 10 more

RDP (Remote Desktop Protocol) from the Internet source medium: This rule detects network events that may indicate the use of RDP traffic from the Internet. RDP is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1021, T1021.001, T1133, T1190
React2Shell Network Security Alert source high: This rule identifies network security alerts related to CVE-2025-55182 exploitation attempts from different network security integrations. CVE-2025-55182 is a critical remote code execution vulnerability in React Server Components (RSC) Flight protocol. The vulnerability allows attackers to execute arbitrary code on the server by sending specially crafted deserialization payloads that exploit prototype chain traversal to access the Function constructor.T1059, T1059.007, T1190
Roshal Archive (RAR) or PowerShell File Downloaded from the Internet source medium: Detects a Roshal Archive (RAR) file or PowerShell script downloaded from the internet by an internal host. Gaining initial access to a system and then downloading encoded or encrypted tools to move laterally is a common practice for adversaries as a way to protect their more valuable tools and tactics, techniques, and procedures (TTPs). This may be atypical behavior for a managed network and can be indicative of malware, exfiltration, or command and control.T1105
RPC (Remote Procedure Call) from the Internet source high: This rule detects network events that may indicate the use of RPC traffic from the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1133, T1190
RPC (Remote Procedure Call) to the Internet source high: This rule detects network events that may indicate the use of RPC traffic to the Internet. RPC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1021, T1021.003, T1190
SMB (Windows File Sharing) Activity from the Internet source high: This rule detects network events that may indicate inbound Windows file sharing (SMB or CIFS) traffic originating from the Internet. SMB should never be directly reachable from the Internet, as it is a primary target for exploitation by threat actors seeking initial access. Inbound SMB from a public IP is a direct precondition for attacks such as EternalBlue (MS17-010) and related SMB remote code execution vulnerabilities.T1133, T1190
SMB (Windows File Sharing) Activity to the Internet source medium: This rule detects network events that may indicate the use of Windows file sharing (also called SMB or CIFS) traffic to the Internet. SMB is commonly used within networks to share files, printers, and other system resources amongst trusted systems. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector or for data exfiltration.T1048, T1190
SMTP to the Internet on Port 26/TCP source low: This rule detects events that may indicate use of SMTP on TCP port 26 from an internal host to an external destination. This port is commonly used by several popular mail transfer agents to deconflict with the default SMTP port 25. This port has also been used by a malware family called BadPatch for command and control of Windows systems. The rule is scoped to outbound traffic (internal source to external destination) to focus on the command and control and exfiltration use cases, rather than benign internal mail relays or unrelated transit traffic observed by the sensor.T1048, T1071, T1071.003, T1571
VNC (Virtual Network Computing) from the Internet source high: This rule detects network events that may indicate the use of VNC traffic from the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1133, T1190, T1219
VNC (Virtual Network Computing) to the Internet source medium: This rule detects network events that may indicate the use of VNC traffic to the Internet. VNC is commonly used by system administrators to remotely control a system for maintenance or to use shared resources. It should almost never be directly exposed to the Internet, as it is frequently targeted and exploited by threat actors as an initial access or backdoor vector.T1021, T1021.005, T1219

Kusto #

Cortex XDR Incident - High source high: 'A new incident was created in the Cortex XDR portal with a severity "High". Click on the events for incident details. '
Cortex XDR Incident - Low source low: 'A new incident was created in the Cortex XDR portal with a severity "Low". Click on the events for incident details. '
Cortex XDR Incident - Medium source medium: 'A new incident was created in the Cortex XDR portal with a severity "Medium". Click on the events for incident details. '
Palo Alto Prisma Cloud - Access keys are not rotated for 90 days source medium: 'Detects access keys which were not rotated for 90 days.'T1078
Palo Alto Prisma Cloud - Anomalous access key usage source medium: 'Detects anomalous API key usage activity.'T1078
Palo Alto Prisma Cloud - High risk score alert source medium: 'Detects alerts with high risk score value.'T1133
Palo Alto Prisma Cloud - High severity alert opened for several days source medium: 'Detects high severity alert which is opened for several days.'T1133
Palo Alto Prisma Cloud - IAM Group with Administrator Access Permissions source medium: 'Detects IAM Groups with Administrator Access Permissions.'T1078
Palo Alto Prisma Cloud - Inactive user source low: 'Detects users inactive for 30 days.'T1078
Palo Alto Prisma Cloud - Maximum risk score alert source medium: 'Detects alerts with maximum risk score value.'T1133

Show 14 more

Palo Alto Prisma Cloud - Multiple failed logins for user source medium: 'Detects multiple failed logins for the same user account.'T1110
Palo Alto Prisma Cloud - Network ACL allow all outbound traffic source medium: 'Detects network ACLs with outbound rule to allow all traffic.'T1133
Palo Alto Prisma Cloud - Network ACL allow ingress traffic to server administration ports source medium: 'Detects Network ACLs allow ingress traffic to server administration ports.'T1133
Palo Alto Prisma Cloud - Network ACLs Inbound rule to allow All Traffic source medium: 'Detects Network ACLs with Inbound rule to allow All Traffic.'T1133
PaloAlto - Dropping or denying session with traffic source medium: 'Detects dropping or denying session with traffic.'T1133, T1190
PaloAlto - File type changed source medium: 'Detects when file type changed.'T1133, T1190
PaloAlto - Forbidden countries source medium: 'Detects suspicious connections from forbidden countries.'T1133, T1190
PaloAlto - Inbound connection to high risk ports source medium: 'Detects inbound connection to high risk ports.'T1133, T1190
PaloAlto - MAC address conflict source low: 'Detects several users with the same MAC address.'T1133, T1190
PaloAlto - Possible attack without response source high: 'Detects possible attack without response.'T1133, T1190
PaloAlto - Possible flooding source medium: 'Detects possible flooding.'T1133, T1190
PaloAlto - Possible port scan source high: 'Detects possible port scan.'T1595
PaloAlto - Put and post method request in high risk file type source high: 'Detects put and post method request in high risk file type.'T1133, T1190
PaloAlto - User privileges was changed source medium: 'Detects changing of user privileges.'T1133, T1190

Sigma #

Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection source high: Detects potential exploitation attempts of CVE-2024-3400 - an OS command injection in Palo Alto GlobalProtect. This detection looks for suspicious strings that indicate a potential directory traversal attempt or command injection.
Potential CVE-2024-3400 Exploitation - Palo Alto GlobalProtect OS Command Injection - File Creation source medium: Detects suspicious file creations in the Palo Alto Networks PAN-OS' parent telemetry folder, which are processed by the vulnerable 'dt_curl' script if device telemetry is enabled. As said script overrides the shell-subprocess restriction, arbitrary command execution may occur by carefully crafting filenames that are escaped through this function.

Splunk #

Citrix ADC Exploitation CVE-2023-3519 source: The following analytic identifies potential exploitation attempts against Citrix ADC related to CVE-2023-3519. It detects POST requests to specific web endpoints associated with this vulnerability by leveraging the Web datamodel. This activity is significant as CVE-2023-3519 involves a SAML processing overflow issue that can lead to memory corruption, posing a high risk. If confirmed malicious, attackers could exploit this to execute arbitrary code, escalate privileges, or disrupt services, making it crucial for SOC analysts to monitor and investigate these alerts promptly.T1190
Confluence Unauthenticated Remote Code Execution CVE-2022-26134 source medium: The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence. It leverages the Web datamodel to analyze network and CIM-compliant web logs, identifying suspicious URL patterns and parameters indicative of exploitation attempts. This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, and further lateral movement within the network. Immediate investigation and remediation are crucial to prevent extensive damage.T1133, T1190, T1505
Detect Large ICMP Traffic source medium: The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities. If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.T1095
Detect Outbound LDAP Traffic source: The following analytic identifies outbound LDAP traffic to external IP addresses. It leverages the Network_Traffic data model to detect connections on ports 389 or 636 that are not directed to private IP ranges (RFC1918). This activity is significant because outbound LDAP traffic can indicate potential data exfiltration or unauthorized access attempts. If confirmed malicious, attackers could exploit this to access sensitive directory information, leading to data breaches or further network compromise.T1059, T1190
Detect Remote Access Software Usage Traffic source low: The following analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.T1219
Detect Remote Access Software Usage URL source low: The following analytic detects the execution of known remote access software within the environment. It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.T1219
Exploit Public-Facing Fortinet FortiNAC CVE-2022-39952 source medium: The following analytic detects attempts to exploit the Fortinet FortiNAC CVE-2022-39952 vulnerability. It identifies HTTP POST requests to the URI configWizard/keyUpload.jsp with a payload.zip file. The detection leverages the Web datamodel, analyzing fields such as URL, HTTP method, and user agent. This activity is significant as it indicates an attempt to exploit a known vulnerability, potentially leading to remote code execution. If confirmed malicious, attackers could gain control over the affected system, schedule malicious tasks, and establish persistent access via a remote command and control (C2) server.T1133, T1190
F5 BIG-IP iControl REST Vulnerability CVE-2022-1388 source medium: The following analytic detects attempts to exploit the F5 BIG-IP iControl REST API vulnerability (CVE-2022-1388) for unauthenticated remote code execution. It identifies suspicious URI paths and POST HTTP methods, along with specific request headers containing potential commands in the utilcmdargs field and a random base64 encoded value in the X-F5-Auth-Token field. This activity is significant as it targets a critical vulnerability that can allow attackers to execute arbitrary commands on the affected system. If confirmed malicious, this could lead to full system compromise and unauthorized access to sensitive data.T1133, T1190
Fortinet Appliance Auth bypass source medium: The following analytic detects attempts to exploit CVE-2022-40684, a Fortinet appliance authentication bypass vulnerability. It identifies REST API requests to the /api/v2/ endpoint using various HTTP methods (GET, POST, PUT, DELETE) that may indicate unauthorized modifications, such as adding SSH keys or creating new users. This detection leverages the Web datamodel to monitor specific URL patterns and HTTP methods. This activity is significant as it can lead to unauthorized access and control over the appliance. If confirmed malicious, attackers could gain persistent access, reroute network traffic, or capture sensitive information.T1133, T1190
TOR Traffic source medium: The following analytic identifies allowed network traffic to The Onion Router (TOR), an anonymity network often exploited for malicious activities. It leverages data from Next Generation Firewalls, using the Network_Traffic data model to detect traffic where the application is TOR and the action is allowed. This activity is significant as TOR can be used to bypass conventional monitoring, facilitating hacking, data breaches, and illicit content dissemination. If confirmed malicious, this could lead to unauthorized access, data exfiltration, and severe compliance violations, compromising the integrity and security of the network.T1090, T1090.003

Show 3 more

VMWare Aria Operations Exploit Attempt source medium: The following analytic detects potential exploitation attempts against VMWare vRealize Network Insight, specifically targeting the CVE-2023-20887 vulnerability. It monitors web traffic for HTTP POST requests directed at the vulnerable endpoint "/saas./resttosaasservlet." This detection leverages web traffic data, focusing on specific URL patterns and HTTP methods. Identifying this behavior is crucial for a SOC as it indicates an active exploit attempt. If confirmed malicious, the attacker could execute arbitrary code, leading to unauthorized access, data theft, or further network compromise.T1068, T1133, T1190, T1210
VMware Server Side Template Injection Hunt source: The following analytic identifies potential server-side template injection attempts related to CVE-2022-22954. It detects suspicious URL patterns containing "deviceudid" and keywords like "java.lang.ProcessBuilder" or "freemarker.template.utility.ObjectConstructor" using web or proxy logs within the Web Datamodel. This activity is significant as it may indicate an attempt to exploit a known vulnerability in VMware, potentially leading to remote code execution. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise the affected system, posing a severe security risk.T1133, T1190
VMware Workspace ONE Freemarker Server-side Template Injection source low: The following analytic detects server-side template injection attempts related to CVE-2022-22954 in VMware Workspace ONE. It leverages web or proxy logs to identify HTTP GET requests to the endpoint catalog-portal/ui/oauth/verify with the freemarker.template.utility.Execute command. This activity is significant as it indicates potential exploitation attempts that could lead to remote code execution. If confirmed malicious, an attacker could execute arbitrary commands on the server, leading to full system compromise, data exfiltration, or further lateral movement within the network.T1133, T1190

Product-Filtered Rules

These rules use generic transport telemetry with a product-specific filter for Palo Alto Networks.

Kusto #

IP with multiple failed Microsoft Entra ID logins successfully logs in to Palo Alto VPN source medium: This query creates a list of IP addresses with the number of failed login attempts to Entra ID above a set threshold ( default of 5 ). It then looks for any successful Palo Alto VPN logins from any of these IPs within the same timeframe.T1078, T1110
Palo Alto - potential beaconing detected source low: 'Identifies beaconing patterns from Palo Alto Network traffic logs based on recurrent timedelta patterns. The query leverages various KQL functions to calculate time deltas and then compares it with total events observed in a day to find percentage of beaconing. This outbound beaconing pattern to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts. Reference Blog: https://medium.com/@HuntOperator/detect-beaconing-with-flare-elastic-stack-and-intrusion-detection-systems-110dc74e0c56 https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/detect-network-beaconing-via-intra-request-time-delta-patterns/ba-p/779586'T1071, T1571
Palo Alto Threat signatures from Unusual IP addresses source medium: 'Identifies Palo Alto Threat signatures from unusual IP addresses which are not historically seen. This detection is also leveraged and required for MDE and PAN Fusion scenario https://docs.microsoft.com/Azure/sentinel/fusion-scenario-reference#network-request-to-tor-anonymization-service-followed-by-anomalous-traffic-flagged-by-palo-alto-networks-firewall'T1030, T1046, T1071, T1071.001
TI Map Domain entity to PaloAlto source medium: 'Identifies a match in Palo Alto data in CommonSecurityLog table from any Domain IOC from TI'T1071
TI map Domain entity to PaloAlto source medium: 'Identifies a match in Palo Alto data in CommonSecurityLog table from any Domain IOC from TI'T1071
TI Map Email entity to PaloAlto CommonSecurityLog source medium: 'Identifies a match in CommonSecurityLog table from any Email IOC from TI'T1566
TI map Email entity to PaloAlto CommonSecurityLog source medium: 'Identifies a match in CommonSecurityLog table from any Email IOC from TI'T1566
TI Map URL Entity to PaloAlto Data source medium: 'This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in PaloAlto Data.'T1071
TI Map URL Entity to PaloAlto Data source medium: 'This query identifies any URL indicators of compromise (IOCs) from threat intelligence (TI) by searching for matches in PaloAlto Data.'T1071

Compatible Rules

These rules declare Palo Alto Networks connector or schema compatibility without a product-specific query filter.

Kusto #

[Deprecated] - Zinc Actor IOCs domains hashes IPs and useragent - October 2022 source high: Use Microsoft's up-to-date Threat Intelligence solution from the Content Hub to replace the deprecated query with outdated IoCs. Install it from: https://learn.microsoft.com/azure/sentinel/sentinel-solutions-deployT1546
Anomaly found in Network Session Traffic (ASIM Network Session schema) source medium: The rule identifies anomalous pattern in network session traffic based on previously seen data, different Device Action, Network Protocol, Network Direction or overall volume. The rule utilize ASIM normalization, and is applied to any source which supports the ASIM Network Session schema. This rule leverages log summaries generated by a Summary Rule or Summarized Playbook. If no such summaries are available, the rule falls back to direct analysis using ASIM function.T1030, T1046, T1071, T1095, T1210
CreepyDrive request URL sequence source high: 'CreepyDrive uses OneDrive for command and control, however, it makes regular requests to predicatable paths. This detecton will alert when over 20 sequences are observed in a single day.'T1102, T1102.002, T1567, T1567.002
CreepyDrive URLs source high: 'CreepyDrive uses OneDrive for command and control. This detection identifies URLs specific to CreepyDrive.'T1102, T1102.002, T1567, T1567.002
Detect port misuse by anomaly based detection (ASIM Network Session schema) source medium: This rule detects anomalous pattern in port usage. The rule utilize ASIM normalization, and is applied to any source which supports the ASIM Network Session schema. To tune the rule to your environment configure it using the 'NetworkSession_Monitor_Configuration' watchlist. This rule leverages log summaries generated by a Summary Rule or Summarized Playbook. If no such summaries are available, the rule falls back to direct analysis using ASIM function.T1059, T1095, T1190, T1203
Detect port misuse by static threshold (ASIM Network Session schema) source medium: This detection rule detects port usage above the configured threshold. The rule utilize ASIM normalization, and is applied to any source which supports the ASIM Network Session schema. To tune the rule to your environment configure it using the 'NetworkSession_Monitor_Configuration' watchlist. This rule leverages log summaries generated by a Summary Rule or Summarized Playbook. If no such summaries are available, the rule falls back to direct analysis using ASIM function.T1059, T1095, T1190, T1203
Europium - Hash and IP IOCs - September 2022 source high: Identifies a match across various data feeds for hashes and IP IOC related to Europium Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-governmentT1003, T1071
Excessive number of failed connections from a single source (ASIM Network Session schema) source medium: This rule identifies a single source that generates an excessive amount of failed connections. Modify the threshold to change the sensitivity of the rule: the higher the threshold, the less sensitive is the rule and less incidents will be generated. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schemaT1499
GreyNoise TI map IP entity to Network Session Events (ASIM Network Session schema) source medium: This rule identifies a match Network Sessions for which the source or destination IP address is a known GreyNoise IoC. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schemaT1071
IP address of Windows host encoded in web request source medium: This detection will identify network requests in HTTP proxy data that contains Base64 encoded IP addresses. After identifying candidates the query joins with DeviceNetworkEvents to idnetify any machine within the network using that IP address. Alerts indicate that the IP address of a machine within your network was seen with it's IP address base64 encoded in an outbound web request. This method of egressing the IP was seen used in POLONIUM's RunningRAT tool, however the detection is generic.T1041, T1071, T1071.001
Known Forest Blizzard group domains - July 2019 source high: Matches domain name IOCs related to Forest Blizzard group activity published July 2019 with CommonSecurityLog, DnsEvents and VMConnection dataTypes. References: https://blogs.microsoft.com/on-the-issues/2019/07/17/new-cyberthreats-require-new-ways-to-protect-democracy/.T1071
Log4j vulnerability exploit aka Log4Shell IP IOC source high: Identifies a match across various data feeds for IP IOCs related to the Log4j vulnerability exploit aka Log4Shell described in CVE-2021-44228. References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228T1071
M365D Alerts Correlation to non-Microsoft Network device network activity involved in successful sign-in Activity source medium: This content is employed to correlate with Microsoft Defender XDR phishing-related alerts. It focuses on instances where a user successfully connects to a phishing URL from a non-Microsoft network device and subsequently makes successful sign-in attempts from the phishing IP address.T1078
Mercury - Domain, Hash and IP IOCs - August 2022 source high: Identifies a match across various data feeds for domains, hashes and IP IOC related to Mercury Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/T1071
Network Port Sweep from External Network (ASIM Network Session schema) source high: This detection rule detects scenarios when a particular port is being scanned by multiple external sources. The rule utilize ASIM normalization, and is applied to any source which supports the ASIM Network Session schema.T1046, T1590
Phishing link click observed in Network Traffic source medium: 'The purpose of this content is to identify successful phishing links accessed by users. Once a user clicks on a phishing link, we observe successful network activity originating from non-Microsoft network devices. These devices may include Palo Alto Networks, Fortinet, Check Point, and Zscaler devices.'T1566
Port scan detected (ASIM Network Session schema) source medium: This rule identifies a possible port scan, in which a single source tries to access a large number of different ports is a short time frame. This may indicate that a port scanner is trying to identify open ports in order to penetrate a system. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schemaT1046
Possible contact with a domain generated by a DGA source medium: 'Identifies contacts with domains names in CommonSecurityLog that might have been generated by a Domain Generation Algorithm (DGA). DGAs can be used by malware to generate rendezvous points that are difficult to predict in advance. This detection uses the Alexa Top 1 million domain names to build a model of what normal domains look like. It uses this to identify domains that may have been randomly generated by an algorithm. The triThreshold is set to 500 - increase this to report on domains that are less likely to have been randomly generated, decrease it for more likely. The start time and end time look back over 6 hours of data and the dgaLengthThreshold is set to 8 - meaning domains whose length is 8 or more are reported. NOTE - The top1M csv zip file used in the query is dynamic and may produce different results over various time periods. It's important to cross-check the events against the entities involved in the incident.'T1568
Possible Phishing with CSL and Network Sessions source medium: This query looks for malicious URL clicks in phishing email recognized by MDO in correlation with CommonSecurityLogs(CSL) & NetworkSession events. If your workspace doesnt have one of the many data sources required for ASIM it may give informational error which can be safely ignored.T1102, T1566
Potential beaconing activity (ASIM Network Session schema) source low: This rule identifies beaconing patterns from Network traffic logs based on recurrent frequency patterns. Such potential outbound beaconing patterns to untrusted public networks should be investigated for any malware callbacks or data exfiltration attempts as discussed in this Blog. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schema'T1071, T1571
Risky user signin observed in non-Microsoft network device source medium: This content is utilized to identify instances of successful login by risky users, who have been observed engaging in potentially suspicious network activity on non-Microsoft network devices.T1071
RunningRAT request parameters source high: 'This detection will alert when RunningRAT URI parameters or paths are detect in an HTTP request. Id the device blocked this communication presence of this alert means the RunningRAT implant is likely still executing on the source host.'T1041, T1071, T1071.001
Star Blizzard C2 Domains August 2022 source high: Identifies a match across various data feeds for domains related to an actor tracked by Microsoft as Star Blizzard.T1566
Threat Essentials - Time series anomaly for data size transferred to public internet source medium: 'Identifies anomalous data transfer to public networks. The query leverages built-in KQL anomaly detection algorithms that detects large deviations from a baseline pattern. A sudden increase in data transferred to unknown public networks is an indication of data exfiltration attempts and should be investigated. The higher the score, the further it is from the baseline value. The output is aggregated to provide summary view of unique source IP to destination IP address and port bytes sent traffic observed in the flagged anomaly hour. The source IP addresses which were sending less than bytessentperhourthreshold have been exluded whose value can be adjusted as needed . You may have to run queries for individual source IP addresses from SourceIPlist to determine if anything looks suspicious'T1030
TI Map File Hash to CommonSecurityLog Event source medium: 'Identifies a match in CommonSecurityLog Event data from any FileHash IOC from TI'T1071
TI map File Hash to CommonSecurityLog Event source medium: 'Identifies a match in CommonSecurityLog Event data from any FileHash IOC from TI'T1071
TI Map IP entity to Network Session Events (ASIM Network Session schema) source medium: This rule identifies a match Network Sessions for which the source or destination IP address is a known IoC. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schemaT1071
TI map IP entity to Network Session Events (ASIM Network Session schema) source medium: This rule identifies a match Network Sessions for which the source or destination IP address is a known IoC. This analytic rule uses ASIM and supports any built-in or custom source that supports the ASIM NetworkSession schemaT1071
Time series anomaly detection for total volume of traffic source medium: 'Identifies anamalous spikes in network traffic logs as compared to baseline or normal historical patterns. The query leverages a KQL built-in anomaly detection algorithm to find large deviations from baseline patterns. Sudden increases in network traffic volume may be an indication of data exfiltration attempts and should be investigated. The higher the score, the further it is from the baseline value. The output is aggregated to provide summary view of unique source IP to destination IP address and port traffic observed in the flagged anomaly hour. The source IP addresses which were sending less than percentotalthreshold of the total traffic have been exluded whose value can be adjusted as needed . You may have to run queries for individual source IP addresses from SourceIPlist to determine if anything looks suspicious'T1030
Time series anomaly for data size transferred to public internet source medium: 'Identifies anomalous data transfer to public networks. The query leverages built-in KQL anomaly detection algorithms that detects large deviations from a baseline pattern. A sudden increase in data transferred to unknown public networks is an indication of data exfiltration attempts and should be investigated. The higher the score, the further it is from the baseline value. The output is aggregated to provide summary view of unique source IP to destination IP address and port bytes sent traffic observed in the flagged anomaly hour. The source IP addresses which were sending less than bytessentperhourthreshold have been exluded whose value can be adjusted as needed . You may have to run queries for individual source IP addresses from SourceIPlist to determine if anything looks suspicious'T1030
Windows host username encoded in base64 web request source medium: This detection will identify network requests in HTTP proxy data that contains Base64 encoded usernames from machines in the DeviceEvents table. This technique was seen usee by POLONIUM in their RunningRAT tool.T1041, T1071, T1071.001

Package-Only Rules

These rules appear in the Palo Alto Networks Sentinel solution, but their queries do not identify Palo Alto Networks telemetry. They do not count toward Rules.

Kusto #

Microsoft COVID-19 file hash indicator matches source medium: 'Identifies a match in CommonSecurityLog Event data from any FileHash published in the Microsoft COVID-19 Threat Intel Feed - as described at https://www.microsoft.com/security/blog/2020/05/14/open-sourcing-covid-threat-intelligence/'T1204, T1204.002
Palo Alto - possible internal to external port scanning source low: 'Identifies a list of internal Source IPs (10.x.x.x Hosts) that have triggered 10 or more non-graceful tcp server resets from one or more Destination IPs which results in an "ApplicationProtocol = incomplete" designation. The server resets coupled with an "Incomplete" ApplicationProtocol designation can be an indication of internal to external port scanning or probing attack. References: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUvCAK and https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClTaCAK'T1046
Palo Alto - possible nmap scan on with top 100 option source medium: 'Detect possible execution of Nmap top 100 option. This detection will detect scanning of 90% of Top 100 port of NMAP in less than 2 minutes. Unusual port only access through a scan are present in this list which is a good indicator of reconnaissance tactics. Whitelisting of Company scanners is required with implementation of the rule. Ref : https://nmap.org/book/performance-port-selection.html'T1595