paloaltonetworks:troubleshooting:testing_panos
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| paloaltonetworks:troubleshooting:testing_panos [2022/08/16 13:35] – [DNS Security] bstafford | paloaltonetworks:troubleshooting:testing_panos [2023/01/21 16:54] (current) – [DNS Security] bstafford | ||
|---|---|---|---|
| Line 39: | Line 39: | ||
| If protection is not active, the following domains resolve to '' | If protection is not active, the following domains resolve to '' | ||
| - | If protection is active, the following domains resolve to whatever your sinkhole is set to (or nothing if block is set as the action instead of sinkhole). | + | If protection is active, the following domains resolve to whatever your sinkhole is set to (e.g. '' |
| - | * C2 '' | + | |
| - | * DNS Tunneling | + | To find example malicious domains, look in the release notes of the active AV file on the firewall (Setup > Dynamic Updates). Search for < |
| - | * DGA '' | + | |
| - | * Dynamic DNS '' | + | In built AV file based DNS malware detection: |
| - | | + | < |
| - | * Newly Registered Domains '' | + | ( name-of-threatid contains |
| - | * Phishing '' | + | |
| - | * Grayware '' | + | |
| - | * Parked '' | + | Don't block Ad Tracking Domains. This will block anything that uses CNAME. This affects most major sites. |
| - | * Proxy Avoidance and Anonymizers '' | + | |
| - | * Fast Flux '' | + | * Ad Tracking |
| - | * Malicious NRD '' | + | * CNAME Cloaking |
| - | * NXNS Attack '' | + | * Command and Control |
| - | * Dangling Domains '' | + | * Tunnelling |
| - | * DNS Rebinding '' | + | * Infiltration |
| - | * DNS Infiltration '' | + | * NXNS |
| - | * Wildcard Abuse '' | + | * Rebinding |
| - | * Strategically-Aged Domains '' | + | * DGA |
| - | * Compromised DNS '' | + | * Dynamic |
| - | * Ad Tracking Domains '' | + | * Grayware |
| - | * CNAME Cloaking '' | + | * FastFlux |
| + | * Malicious NRD | ||
| + | * Dangling Domain | ||
| + | * Wildcard Abuse | ||
| + | * Strategically Aged | ||
| + | * Parked | ||
| + | * Phishing | ||
| + | * Proxy Avoidance | ||
| + | * Newly Registered Domains | ||
| + | |||
| + | Malicious DNS queries found based on the AV filedownload are categoriesed as '' | ||
| + | |||
| + | < | ||
| + | ^ Default Log Severity ^ Threat Category ^ Test Domain ^ Test Command ^ | ||
| + | | informational | dns-adtracking | test-adtracking.testpanw.com | ||
| + | | informational | dns-adtracking | test-cname-cloaking.testpanw.com | ||
| + | | high | dns-c2 | test-c2.testpanw.com | ||
| + | | high | dns-c2 | test-dnstun.testpanw.com | ||
| + | | high | dns-c2 | test-dns-infiltration.testpanw.com | ||
| + | | high | dns-c2 | test-nxns.testpanw.com | ||
| + | | high | dns-c2 | test-dns-rebinding.testpanw.com | ||
| + | | high | dns-c2 | test-dga.testpanw.com | ||
| + | | informational | dns-ddns | test-ddns.testpanw.com | ||
| + | | low | dns-grayware | test-grayware.testpanw.com | dig +short @8.8.8.8 A test-grayware.testpanw.com | | ||
| + | | low | dns-grayware | test-fastflux.testpanw.com | ||
| + | | low | dns-grayware | test-malicious-nrd.testpanw.com | ||
| + | | low | dns-grayware | test-dangling-domain.testpanw.com | ||
| + | | low | dns-grayware | test-wildcard-abuse.testpanw.com | ||
| + | | low | dns-grayware | test-strategically-aged.testpanw.com | ||
| + | | medium | dns-malware | test-malware.testpanw.com | dig +short @8.8.8.8 A test-malware.testpanw.com | | ||
| + | | medium | dns-malware | test-compromised-dns.testpanw.com | ||
| + | | informational | dns-parked | test-parked.testpanw.com | ||
| + | | low | dns-phishing | test-phishing.testpanw.com | dig +short @8.8.8.8 A test-phishing.testpanw.com | ||
| + | | low | dns-proxy | test-proxy.testpanw.com | dig +short @8.8.8.8 A test-proxy.testpanw.com | | ||
| + | | low | dns-new-domain | test-nrd.testpanw.com | dig +short @8.8.8.8 A test-nrd.testpanw.com | | ||
| < | < | ||
| < | < | ||
| + | |||
| + | |||
| + | |||
| + | < | ||
| + | dig +short @8.8.8.8 A test-cname-cloaking.testpanw.com | ||
| + | |||
| + | dig +short @8.8.8.8 A test-c2.testpanw.com | ||
| + | dig +short @8.8.8.8 A test-dnstun.testpanw.com | ||
| + | dig +short @8.8.8.8 A test-dns-infiltration.testpanw.com | ||
| + | dig +short @8.8.8.8 A test-nxns.testpanw.com | ||
| + | dig +short @8.8.8.8 A test-dns-rebinding.testpanw.com | ||
| + | dig +short @8.8.8.8 A test-dga.testpanw.com | ||
| + | |||
| + | dig +short @8.8.8.8 A test-ddns.testpanw.com | ||
| + | |||
| + | dig +short @8.8.8.8 A test-grayware.testpanw.com | ||
| + | dig +short @8.8.8.8 A test-fastflux.testpanw.com | ||
| + | dig +short @8.8.8.8 A test-malicious-nrd.testpanw.com | ||
| + | dig +short @8.8.8.8 A test-dangling-domain.testpanw.com | ||
| + | dig +short @8.8.8.8 A test-wildcard-abuse.testpanw.com | ||
| + | dig +short @8.8.8.8 A test-strategically-aged.testpanw.com | ||
| + | |||
| + | dig +short @8.8.8.8 A test-malware.testpanw.com | ||
| + | dig +short @8.8.8.8 A test-compromised-dns.testpanw.com | ||
| + | |||
| + | dig +short @8.8.8.8 A test-parked.testpanw.com | ||
| + | |||
| + | dig +short @8.8.8.8 A test-phishing.testpanw.com | ||
| + | |||
| + | dig +short @8.8.8.8 A test-proxy.testpanw.com | ||
| + | |||
| + | dig +short @8.8.8.8 A test-nrd.testpanw.com</ | ||
| ====Vulnerability Protection==== | ====Vulnerability Protection==== | ||
| As listed in this [[https:// | As listed in this [[https:// | ||
| Line 153: | Line 219: | ||
| * **-S < | * **-S < | ||
| + | === Test Ping Broadcast Flood === | ||
| + | < | ||
| === Test UDP Flood === | === Test UDP Flood === | ||
| The following command will cause a UDP flood | The following command will cause a UDP flood | ||
paloaltonetworks/troubleshooting/testing_panos.1660656946.txt.gz · Last modified: (external edit)