6.2 Vulnerability Protection, Custom Signatures, and Threat Exceptions

6.2 Vulnerability Protection, Custom Signatures, and Threat Exceptions

While Antivirus and Anti-Spyware profiles focus primarily on malicious files and outbound command-and-control channels, Vulnerability Protection Profiles protect enterprise systems from inbound and lateral exploit attempts. Software applications, operating systems, and network services frequently contain unpatched security vulnerabilities—such as buffer overflows, SQL injections, cross-site scripting (XSS), and remote code execution (RCE) flaws. Vulnerability Protection profiles detect and neutralize exploit payloads targeting these weaknesses in real time.

---

Vulnerability Protection Profiles and Severities

Palo Alto Networks Threat Intelligence continuously publishes vulnerability signatures derived from CVE disclosures, security research, and global telemetry. Vulnerability signatures are categorized into six standardized severity levels:

• Critical: Exploits that cause widespread, catastrophic system compromise or unauthenticated remote code execution without user interaction.
• High: Exploits targeting major system vulnerabilities that can grant elevated privileges or lead to severe data exposure.
• Medium: Exploits requiring specific configurations or partial authentication to execute successfully.
• Low: Vulnerabilities that result in limited information disclosure or minor service disruptions.
• Informational: Event-level signatures monitoring specific application behaviors, administrative tools, or protocol usage patterns.
• High-Option / Custom: Administrator-configured threshold rules and custom vulnerability definitions.

Rules and Action Matrix

Security administrators configure profile rules matching combinations of threat severity, category, and host orientation (client, server, or any):

Block IP Action

When an exploit signature triggers the block-ip action, PAN-OS dynamically adds the attacking source IP address (or destination IP address) to an inline temporary block list for a designated period (ranging from 1 to 3600 seconds). This prevents brute-force exploit attempts or automated vulnerability scanning across all sessions originating from that IP.

---

Custom Threat Signatures

When proprietary software applications encounter zero-day threats or specialized internal compliance requirements arise, security engineers can create Custom Threat Signatures in PAN-OS. Custom signatures belong to dedicated ID ranges (IDs 15000–18000 for custom spyware/vulnerabilities and 6000000+ for custom object IDs).

Key Concepts of Custom Signature Design

1. Threat Type & ID: Define whether the signature represents a vulnerability or spyware threat, assigning a unique ID and threat name.
2. Protocol and Context Scope: Signatures must specify the precise application decoder context to evaluate. Choosing the narrowest relevant context minimizes processing overhead and false positives. Examples include:
   • http-req-host-header: Inspects the Host header field in HTTP requests.
   • http-req-uri-path: Analyzes the URI path portion of web requests.
   • http-req-headers: Evaluates all HTTP request header structures.
   • file-type-ident-header: Matches specific file magic bytes during file transfer.
3. Pattern Match vs. Regex: Signatures can use exact string pattern matching or POSIX-compliant regular expressions (Regex). Regex patterns support case insensitivity, hexadecimal byte patterns (e.g., \x90\x90\x90 for NOP sleds), and wildcards.
4. Ordered Pattern Matching & Combinations: Complex signatures can combine multiple conditions using logical operators (AND / OR). For example, a custom signature might require matching a specific URI string AND an anomalous HTTP User-Agent string within the same session.

---

Threat Exceptions and Overrides

In operational environments, emergency patches, vulnerability scanners, or legacy internal software may trigger false-positive alerts on specific threat signatures. Rather than disabling an entire Vulnerability Protection profile or turning off security rules globally, PAN-OS provides Threat Exceptions.

Signature-Level vs. Rule-Based Exemptions

• Signature-Level Exception: Modifies the enforcement action of a specific Threat ID (e.g., changing Threat ID #30001 from drop to alert) across the entire Security Profile.
• IP Address Exemptions: Restricts a threat exception so that it applies only to designated source or destination IP addresses. For instance, a vulnerability scanner host IP (10.50.1.100) can be exempted from triggering exploit drop actions during scheduled penetration testing windows, while all other network hosts remain strictly protected by the default drop action.

Global Signature DB (ID #40112: Drop Action)
       |
       +---> Applied to General Vulnerability Profile
                 |
                 +---> Threat Exception Rule:
                           - Target Signature: ID #40112
                           - Action: Exempt / Alert
                           - IP Filter: Source IP = 10.50.1.100 (Scanner IP Only)
                 |
                 +---> Result: All hosts dropped EXCEPT 10.50.1.100 (Alert Only)

---

Packet Capture (PCAP) for Forensics

When a high-severity exploit signature triggers, security analysts require forensic evidence to verify whether an attack succeeded. Vulnerability Protection profiles support automated Packet Capture (PCAP):

• Single-Packet PCAP: Captures the exact packet that matched the threat signature.
• Extended-Packet PCAP: Captures up to 5 packets prior to the threat match and up to 15 packets after the match, providing full session context surrounding the exploit payload.
• PCAP Retrieval: Captured .pcap files are stored in firewall local storage and can be directly downloaded from the Monitor > Logs > Threat interface for Wireshark analysis.

---

Security Profile Groups

To simplify security administration and maintain policy consistency across large enterprise deployments, PAN-OS utilizes Security Profile Groups. A Security Profile Group bundles individual security profiles into a single managed container:

• Antivirus Profile
• Anti-Spyware Profile
• Vulnerability Protection Profile
• URL Filtering Profile
• File Blocking Profile
• WildFire Analysis Profile
• DNS Security Profile

Operational Advantages

Instead of manually attaching seven individual profiles to dozens of Security Policy rules, administrators attach the single Security Profile Group. When updates or tuning changes are made to a profile within the group, the change automatically propagates across all policy rules referencing that group, eliminating configuration drift and administrative errors.