UTMSTACK logoUTMSTACK logo
Palo Alto

Detection rules for Palo Alto data sources. Each rule includes its MITRE ATT&CK mapping, impact rating, and a description of what it detects.

This category contains 7 detection rules.

RuleCategoryTechniqueImpact (C/I/A)
IOC Match from Threat Intelligence FeedDefense EvasionT1027 - Obfuscated Files or InformationC:3 / I:3 / A:2
PAN-OS DNS Security Alert DetectionCommand and ControlT1071.004 - Application Layer Protocol: DNSC:3 / I:2 / A:1
PAN-OS Malicious URL Category BlockCommand and ControlT1071.001 - Application Layer Protocol: Web ProtocolsC:3 / I:2 / A:1
PAN-OS Management Plane Login Brute ForceCredential AccessT1110 - Brute ForceC:3 / I:3 / A:1
PAN-OS Spyware and Vulnerability Threat DetectionIntrusion DetectionT1190 - Exploit Public-Facing ApplicationC:3 / I:3 / A:2
WildFire Malware DetectionExecutionT1204.002 - User Execution: Malicious FileC:3 / I:3 / A:2
Zero-Day Exploit PreventionExecutionT1203 - Exploitation for Client ExecutionC:3 / I:3 / A:3

Rule Example

Below is an example of a rule definition for IOC Match from Threat Intelligence Feed (view in repository):

# Rule version v1.0.0

dataTypes:
  - firewall-paloalto
name: IOC Match from Threat Intelligence Feed
impact:
  confidentiality: 3
  integrity: 3
  availability: 2
category: Defense Evasion
technique: "T1027 - Obfuscated Files or Information"
adversary: origin
references:
  - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/threat-intelligence-management
  - https://attack.mitre.org/techniques/T1027/
description: |
  Detects when network traffic matches known Indicators of Compromise (IOCs) from threat intelligence feeds. This includes malicious IPs, domains, URLs, or file hashes associated with known threat actors or campaigns. The Palo Alto firewall has identified and blocked traffic based on threat intelligence data.

  Next Steps:
  1. Review the specific IOC that triggered the alert and verify its legitimacy
  2. Investigate the source IP address for additional suspicious activities
  3. Check if the same IOC has been observed from other internal hosts
  4. Examine the target destination for potential compromise indicators
  5. Update threat intelligence feeds and firewall rules as necessary
  6. Consider isolating affected hosts if compromise is confirmed
  7. Document the incident and IOC details for threat hunting activities
where: |
  (contains("log.panOSThreatCategory", "malware") ||
   contains("log.panOSThreatCategory", "command-and-control") ||
   contains("log.panOSThreatCategory", "phishing") ||
   contains("log.panOSThreatCategory", "botnet") ||
   contains("log.msg", "threat-intel") ||
   contains("log.msg", "ioc-match")) &&
  oneOf("log.panOSAction", ["block", "deny", "drop", "reset-both", "reset-client", "reset-server"])
groupBy:
  - lastEvent.log.panOSThreatID
  - adversary.ip
  - target.ip

Rule Details

IOC Match from Threat Intelligence Feed

Detects when network traffic matches known Indicators of Compromise (IOCs) from threat intelligence feeds. This includes malicious IPs, domains, URLs, or file hashes associated with known threat actors or campaigns. The Palo Alto firewall has identified and blocked traffic based on threat intelligence data.

PAN-OS DNS Security Alert Detection

Detects PAN-OS DNS Security alerts including DNS sinkholing, domain generation algorithm (DGA) detection, DNS tunneling, and queries to known malicious domains. These alerts indicate potential C2 communication or data exfiltration via DNS.

PAN-OS Malicious URL Category Block

Detects URL filtering blocks for malicious, phishing, or command-and-control URL categories on Palo Alto firewalls. Repeated blocks from the same host may indicate malware infection or compromised credentials.

PAN-OS Management Plane Login Brute Force

Detects multiple failed login attempts to the PAN-OS management plane (web UI, SSH, or API), indicating potential brute force attacks against firewall administrative credentials.

PAN-OS Spyware and Vulnerability Threat Detection

Detects spyware and vulnerability threat detections from PAN-OS threat prevention engine. These alerts indicate active exploitation attempts, spyware callbacks, or known vulnerability exploitation against protected hosts.

WildFire Malware Detection

Detects when WildFire identifies malicious files or malware based on threat analysis. This rule triggers on files with malicious verdicts from WildFire's advanced analysis engine, indicating potential malware execution or file-based threats.

Zero-Day Exploit Prevention

Detects potential zero-day exploits blocked by Palo Alto's threat prevention engine. This rule triggers on high-severity vulnerability attempts and unknown threat patterns that may indicate zero-day exploit attempts. The rule looks for THREAT type events with vulnerability or exploit subtypes that have high or critical severity, and either contain CVE references or are categorized as unknown threats.