Objects > Security Profiles > Anti-Spyware Profile
You can attach an Anti-Spyware profile to a Security policy rule to detect connections initiated by spyware and command-and-control (C2) malware installed on systems on your network. You can choose between two predefined Anti-Spyware profiles to attach to a Security policy rule. Each profile has a set of predefined rules (with threat signatures) organized by the severity of the threat; each threat signature includes a default action that is specified by Palo Alto Networks.
- Default—The default profile uses the default action for every signature, as specified by Palo Alto Networks when the signature is created.
- Strict—The strict profile overrides the action defined in the signature file for critical, high, and medium severity threats, and sets it to the reset-both action. The default action is taken with low and informational severity threats.
- You can also create custom profiles. You can, for example, reduce the stringency for Anti-Spyware inspection for traffic between trusted security zones, and maximize the inspection of traffic received from the internet, or traffic sent to protected assets such as server farms.
The following tables describe the Anti-Spyware profile settings:
Anti-Spyware Profile Settings
Enter a profile name (up to 31 characters). This name appears in the list of Anti-Spyware profiles when defining security policies. The name is case-sensitive and must be unique. Use only letters, numbers, spaces, hyphens, periods, and underscores.
Enter a description for the profile (up to 255 characters).
Select this option if you want the profile to be available to:
Disable override (Panorama only)
Select this option to prevent administrators from overriding the settings of this Anti-Spyware profile in device groups that inherit the profile. This selection is cleared by default, which means administrators can override the settings for any device group that inherits the profile.
Anti-Spyware rules allow you to define a custom severity and action to take on any threat, a specific threat name that contains the text that you enter, and/or by a threat category, such as adware.
Add a new rule, or you can select an existing rule to and select Find Matching Signatures to filter threat signatures based on that rule.
Specify the rule name.
Enter any to match all signatures, or enter text to match any signature containing the entered text as part of the signature name.
Choose a severity level (critical, high, medium, low, or informational).
Choose an action for each threat. For a list of actions, see Actions in Security Profiles.
For the best security, use the Action settings in the predefined strict profile.
Select this option if you want to capture identified packets.
Select single-packet to capture one packet when a threat is detected, or select the extended-capture option to capture from 1 to 50 packets (default is 5 packets). Extended-capture provides more context about the threat when analyzing the threat logs. To view the packet capture, select MonitorLogsThreat, locate the log entry you are interested in, and then click the green down arrow in the second column. To define the number of packets to capture, select DeviceSetupContent-ID and then edit the Content-ID™ Settings.
Packet captures only occur if the action is allow or alert. If the block action is set, the session ends immediately.
Enable extended-capture for critical, high, and medium severity events. Use the default extended-capture value of 5 packets, which provides enough information to analyze the threat in most cases. (Too much packet capture traffic may result in dropping packet captures.) Don’t enable extended-capture for informational and low severity events because it’s not very useful compared to capturing information about higher severity events and creates a relatively high volume of low-value traffic.
Allows you to change the action for a specific signature. For example, you can generate alerts for a specific set of signatures and block all packets that match all other signatures. Threat exceptions are usually configured when false-positives occur. To make management of threat exceptions easier, you can add threat exceptions directly from the MonitorLogsThreat list. Ensure that you obtain the latest content updates so that you are protected against new threats and have new signatures for any false-positives.
Select Enable for each threat for which you want to assign an action, or select All to respond to all listed threats. The list depends on the selected host, category, and severity. If the list is empty, there are no threats for the current selections.
Use the IP Address Exemptions column to add IP address filters to a threat exception. If IP addresses are added to a threat exception, the threat exception action for that signature will only be taken over the rule's action if the signature is triggered by a session having either the source or destination IP matching an IP in the exception. You can add up to 100 IP addresses per signature. With this option, you do not have to create a new policy rule and new vulnerability profile to create an exception for a specific IP address.
Only create an exception if you are sure a signature identified as spyware is not a threat (false positive). If you believe you have discovered a false positive, open a support case with TAC so Palo Alto Networks can analyze and fix the incorrectly identified signature. When the issue is resolved, remove the exception from the profile immediately.
DNS Signature Tab
The DNS Signatures settings provides an additional method of identifying infected hosts on a network. These signatures detect specific DNS lookups for host names that have been associated with malware. The DNS signatures can be configured to allow, alert, sinkhole, or block when these queries are observed, just as with regular antivirus signatures. Additionally, hosts that perform DNS queries for malware domains will appear in the botnet report. DNS signatures are downloaded as part of the antivirus updates.
External Dynamic List Domains
Allows you to select the lists for which you want to enforce an action when a DNS query occurs. By default, the list of DNS signatures provided through content updates (Palo Alto Networks DNS Signatures list) is sinkholed. The default IP address used for sinkholing belongs to Palo Alto Networks (22.214.171.124). This IP address is not static and can be modified through content updates on the firewall or Panorama.
To add a new list, click Add and select the External Dynamic List of type Domain that you had created. To create a new list, see Objects > External Dynamic Lists.
Action on DNS queries
Choose an action to take when DNS lookups are made to known malware sites. The options are alert, allow, block, or sinkhole. The default action for Palo Alto Networks DNS signatures is sinkhole.
The DNS sinkhole action provides administrators with a method of identifying infected hosts on the network using DNS traffic, even when the firewall is north of a local DNS server (for example, the firewall cannot see the originator of the DNS query). When a threat prevention license is installed and an Anti-Spyware profile is enabled in a Security Profile, the DNS-based signatures trigger on DNS queries directed at malware domains. In a typical deployment where the firewall is north of the local DNS server, the threat log identifies the local DNS resolver as the source of the traffic rather than the actual infected host. Sinkholing malware DNS queries solves this visibility problem by forging responses to the queries directed at malicious domains, so that clients attempting to connect to malicious domains (for command-and-control, for example) instead attempt connections to an IP address specified by the administrator. Infected hosts can then be easily identified in the traffic logs because any host that attempts to connect to the sinkhole IP are most likely infected with malware.
Enable DNS sinkhole when the firewall can’t see the originator of the DNS query (typically when the firewall is north of the local DNS server) so you can identify infected hosts. If you can’t sinkhole the traffic, block it.
After selecting the sinkhole action, specify an IPv4 and/or IPv6 address that will be used for sinkholing. By default, the sinkhole IP address is set to a Palo Alto Networks server. You can then use the traffic logs or build a custom report that filters on the sinkhole IP address and identify infected clients.
The following is the sequence of events that occur when an DNS request is sinkholed:
Malicious software on an infected client computer sends a DNS query to resolve a malicious host on the Internet.
The client's DNS query is sent to an internal DNS server, which then queries a public DNS server on the other side of the firewall.
The DNS query matches a DNS entry in the DNS signatures database, so the sinkhole action will be performed on the query.
The infected client then attempts to start a session with the host, but uses the forged IP address instead. The forged IP address is the address defined in the Anti-Spyware profile DNS Signatures tab when the sinkhole action is selected.
The administrator is alerted of a malicious DNS query in the threat log, and can then search the traffic logs for the sinkhole IP address and can easily locate the client IP address that is trying to start a session with the sinkhole IP address.
Select this option if you want to capture identified packets.
Enable packet capture on sinkholed traffic so you can analyze it and get information about the infected host.
Manually enter DNS signature exceptions (range is 4000000-4999999).
Configure DNS Sinkholing for a List of Custom Domains
Configure DNS Sinkholing for a List of Custom Domains To enable DNS Sinkholing for a custom list of domains, you must create an External Dynamic ...
Use DNS Queries to Identify Infected Hosts on the Network
Use DNS Queries to Identify Infected Hosts on the Network The DNS sinkhole action in Anti-Spyware profiles enables the firewall to forge a response to ...
Identify Infected Hosts
Identify Infected Hosts After you have configured DNS sinkholing and verified that traffic to a malicious domain goes to the sinkhole address, you should regularly ...
Take a Threat Packet Capture
Take a Threat Packet Capture To configure the firewall to take a packet capture (pcap) when it detects a threat, enable packet capture on Antivirus, ...
Review Threat Logs
Review Threat Logs To begin investigating the alert, use the threat ID to search the Threat logs on Panorama ( Monitor Logs Threat ). From ...
DNS Sinkholing DNS sinkholing helps you to identify infected hosts on the protected network using DNS traffic in situations where the firewall cannot see the ...
Create the Data Center Best Practice Anti-Spyware Profile
Protect your data center from spyware such as command-and-control, backdoor, data theft, and keylogging attacks. ...
Configure the Sinkhole IP Address to a Local Server on Your...
Configure the Sinkhole IP Address to a Local Server on Your Network By default, sinkholing is enabled for all Palo Alto Networks DNS signatures, and ...
Enable Threat Packet Capture
Enable Threat Packet Capture Objects > Security Profiles To enable the firewall to capture packets when it detects a threat, enable the packet capture option ...