6.1 Antivirus, Anti-Spyware, and DNS Security Profiles

6.1 Antivirus, Anti-Spyware, and DNS Security Profiles

Palo Alto Networks Next-Generation Firewalls (NGFWs) deliver comprehensive threat prevention through Content-ID, an integrated security processing engine designed to inspect all traffic across all ports and protocols. Unlike legacy stateful firewalls that rely strictly on port-based rules or traditional proxy-based security gateways that buffer entire files before analysis, PAN-OS utilizes a hardware-accelerated Single-Pass Architecture (SPA). This architectural model decoupling hardware processing allows packet payloads to be scanned simultaneously for viruses, spyware, vulnerabilities, and malicious domains without degrading throughput or adding processing latency.

At the core of content inspection are Security Profiles, which define the specific threat scanning rules, decoders, and enforcement actions applied to allowed network sessions. Security Profiles are attached to Security Policy rules that have an allow action, ensuring that permitted traffic is thoroughly sanitized before reaching internal hosts or traversing trust boundaries.

---

Stream-Based Scanning vs. File-Based Proxy Scanning

Traditional network security appliances rely on file-based proxy scanning, which requires the firewall to buffer complete files in memory before handing them off to an antivirus engine. This approach creates severe performance bottlenecks, introduces noticeable latency for users downloading large files, and exposes the firewall to buffer exhaustion attacks.

In contrast, Palo Alto Networks implements stream-based scanning, inspecting packets in real-time as they stream through the data plane:

• Uniform Signature Matching: The Content-ID engine scans incoming packet streams against a unified signature database in a single processing pass, eliminating redundant memory lookups.
• Zero Latency Overhead: File content is evaluated continuously on a byte-by-byte basis. The firewall does not buffer entire files in RAM, enabling unconstrained file size scanning across high-throughput links.
• Protocol Decoders: Dedicated protocol decoders normalize traffic for protocols including HTTP, HTTPS (when SSL Decryption is enabled), SMTP, IMAP, POP3, FTP, and SMB, ensuring signatures are evaluated within the correct application context.

---

Antivirus Profiles

Antivirus Profiles shield internal networks from viruses, worms, Trojans, and weaponized file attachments. The profile applies virus signatures generated by Palo Alto Networks Threat Intelligence and WildFire analysis engines.

Decoder Configuration and Actions

Within an Antivirus Profile, security engineers configure enforcement actions independently for each protocol decoder. PAN-OS supports the following actions:

• default: Enforces the default action defined within the Palo Alto Networks threat signature (typically drop or reset-both).
• allow: Permits the file transmission despite a signature match (used primarily for baseline testing).
• alert: Generates a Threat Log entry while allowing the packet stream to proceed.
• drop: Silently discards packets matching the virus signature.
• reset-client: Drops the packet stream and sends a TCP RST packet to the client endpoint.
• reset-server: Drops the packet stream and sends a TCP RST packet to the server host.
• reset-both: Sends TCP RST packets to both client and server endpoints, instantly tearing down the TCP connection.

Wildcard and Custom Virus Signatures

While daily dynamic updates deliver thousands of verified virus signatures, organizations facing targeted threats or custom malware variants can define wildcard virus signatures and custom antivirus signatures. Custom signatures leverage pattern matching across specific header fields or file payloads, allowing security administrators to block proprietary threats prior to official vendor coverage.

---

Anti-Spyware Profiles and Command-and-Control (C2) Prevention

While Antivirus Profiles focus on payload delivery, Anti-Spyware Profiles block spyware, adware, keyloggers, and ongoing Command-and-Control (C2) communications initiated by already compromised internal endpoints.

C2 Domain Detection and Passive DNS

When malware infects a host, it attempts to phone home to external attacker infrastructure to receive commands, exfiltrate data, or download secondary payloads. Anti-Spyware Profiles analyze outbound traffic for known C2 patterns, suspicious HTTP headers, IRC botnet channels, and unauthorized protocol behavior. Additionally, PAN-OS collects passive DNS telemetry to identify anomalous domain resolutions occurring across the enterprise.

DNS Sinkholing Mechanics

One of the most powerful features of the Anti-Spyware Profile is DNS Sinkholing. When an infected host generates a DNS query requesting the IP address of a known malicious C2 domain, the firewall intercepts the DNS response and replaces the real malicious IP address with a designated Sinkhole IP (a controlled loopback or internal IP address).

[ Compromised Host ] ---> DNS Query: bad-c2-domain.com ---> [ Palo Alto NGFW ]
                                                                   |
                                                        Intercepts DNS & Checks C2 DB
                                                                   |
[ Compromised Host ] <--- DNS Response: 192.0.2.242 <--------------+
        |
   Attempts Connection to 192.0.2.242 (Sinkhole IP)
        |
[ Firewalled Gateway Logs Threat with Source Host IP! ]

Why Sinkholing is Essential for Incident Response

In environments where internal endpoints route DNS queries through an internal DNS server (such as an Active Directory Domain Controller), the firewall only sees the DNS server's IP address as the source of the query. Without sinkholing, identifying the actual infected endpoint requires parsing thousands of internal DNS logs.

With DNS Sinkholing enabled:

1. The firewall alters the DNS response returned to the internal DNS server, which passes it back to the client host.
2. The infected host attempts to establish an IP connection directly to the Sinkhole IP (e.g., 192.0.2.242 or 2001:db8::sinkhole).
3. The host's connection attempt hits a Security Policy rule blocking or logging access to the Sinkhole IP.
4. The firewall instantly logs the true source IP address of the compromised host in the Traffic and Threat Logs, enabling immediate automated or manual containment.

---

Palo Alto Networks DNS Security Subscription

Modern attackers bypass static signature databases by employing Domain Generation Algorithms (DGAs), fast-flux DNS infrastructure, and DNS Tunneling techniques to exfiltrate sensitive data over UDP port 53. To counter these advanced threats, the Palo Alto Networks DNS Security cloud service extends Anti-Spyware profiles with real-time machine learning.

Advanced DNS Protection Features

• Real-Time Cloud Inspection: Evaluates unknown DNS queries in under 10 milliseconds by querying Palo Alto Networks threat intelligence cloud engines.
• DGA Detection: Uses inline machine learning models to detect dynamically generated domain names (e.g., x7k9p2q1w.com) created by malware families in real time.
• DNS Tunneling Prevention: Analyzes query length, entropy, record types (TXT, NULL, CNAME), and request frequency to block covert data exfiltration channels abusing DNS protocols.
• Ultra-New Domain (UND) Blocking: Classifies newly registered domains (NRDs) and newly observed domains, allowing administrators to automatically block access to domains registered within the past 32 minutes to 24 hours.

---

Profile Feature Comparison

The following table compares the scope, inspection mechanisms, and target vectors of Content-ID security profiles: