Detections
Analytics

PANW-AG-000049 - The Palo Alto Networks security platform must block phone home traffic.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

A variety of Distributed Denial of Service (DDoS) attacks and other attacks use 'botnets' as an attack vector. A botnet is a collection of software agents (referred to as 'bot'), residing on compromised computers. Attacks are orchestrated by a 'bot herder' to command these agents to launch attacks. Part of the command and control communication between the controller and the bots is a message sent from a bot that informs the controller that it is operating. This is referred to as a 'phone home' message.

On the Palo Alto Networks security platform, a security policy can include an Anti-spyware Profile for 'phone home' detection (detection of traffic from installed spyware). The device has two pre-configured Anti-spyware Profiles; Default and Strict. The Default Anti-spyware Profile sends an alert for detected phone-home traffic for all severity levels except the low and informational severity threat levels, while the Strict Anti-spyware Profile blocks phone-home traffic for the critical, high, and medium severity threat levels.

Phone home traffic must either be blocked or intercepted by the DNS Sinkholing feature. Therefore, a custom Anti-spyware Profile or the Strict Anti-spyware Profile must be used instead of the Default Anti-spyware Profile. Note that there are specific implementation requirements for DNS Sinkholing to operate properly; refer to the Palo Alto Networks documentation for details.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Go to Objects >> Security Profiles >> Anti-Spyware
Select the name of a configured Anti-Spyware Profile or select 'Add' to create a new one.
In the 'Anti-Spyware Profile' window, in the 'DNS Signatures' tab, in the Action on 'DNS queries' field, select 'block' or 'sinkhole'.
If 'sinkhole' is selected, complete the 'Sinkhole IPv4' and 'Sinkhole IPv6' fields.

Note: If DNS Sinkholing is used, the device and network must be configured to support it.

If this is a new Anti-Spyware Profile, complete the required fields in all tabs.
Select 'OK'.
Use the Anti-Spyware Profile in a Security Policy;
Edit the Security Policy Rule that allows traffic from client hosts in the trust zone to the untrust zone to include the sinkhole zone as a destination and attach the Anti-spyware Profile. Select or configure a rule that allows traffic from the client host zone to the untrust zone.

Go to Policies >> Security
Select the appropriate existing policy rule or select 'Add' to create a new one.
In the 'Actions' tab in the 'Profile Setting' section; in the 'Profile Type' field, select 'Profiles'. The window will change to display the different categories of Profiles.
In the 'Actions' tab in the 'Profile Setting' section; in the 'Anti-Spyware' field, select the configured Anti-Spyware Profile.
Select 'OK'.
Commit changes by selecting 'Commit' in the upper-right corner of the screen.
Select 'OK' when the confirmation dialog appears.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_PAN_Y22M04_STIG.zip

Item Details

References: CAT|II, CCI|CCI-001094, Rule-ID|SV-228843r557387_rule, STIG-ID|PANW-AG-000049, STIG-Legacy|SV-77059, STIG-Legacy|V-62569, Vuln-ID|V-228843

Plugin: Palo_Alto

Control ID: 8974a575e6ecc79df42a9f241ca8e8b313498125cfd50ade6d1026af5d633a13