Detect Blocked Exploits, Spyware and Malware in Palo Alto PAN-OS CEF Logs

title: Palo Alto PAN-OS Threat Blocked (Exploit, Spyware or Malware)
id: 3a7c9e02-5d14-4f6b-8e2a-0b9f4d1c6a73
status: experimental
description: >
  Detects a Palo Alto PAN-OS threat log in CEF where the firewall matched a
  vulnerability exploit, spyware (command-and-control) or malware signature and
  stopped the traffic. In PAN-OS CEF the header's Device Event Class ID carries
  the threat subtype and its Name is THREAT; the act key carries the action.
  Field names below follow Microsoft Sentinel's CommonSecurityLog table.
references:
  - https://docs.paloaltonetworks.com/resources/cef
  - https://attack.mitre.org/techniques/T1190/
  - https://attack.mitre.org/techniques/T1071/
author: LogTriage
date: 2026/10/19
modified: 2026/10/20
logsource:
  product: paloalto
  service: threat
detection:
  threat_match:
    DeviceVendor: 'Palo Alto Networks'
    Activity: 'THREAT'
    DeviceEventClassID:
      - 'vulnerability'
      - 'spyware'
      - 'virus'
      - 'wildfire-virus'
  blocked:
    DeviceAction:
      - 'drop'
      - 'drop-all-packets'
      - 'reset-both'
      - 'reset-client'
      - 'reset-server'
      - 'block-ip'
  condition: threat_match and blocked
falsepositives:
  - Sanctioned scanner or penetration test from a known source address
  - A signature misfiring on legitimate traffic that resembles attack syntax
level: medium
tags:
  - attack.initial_access
  - attack.t1190
  - attack.command_and_control
  - attack.t1071

What this rule detects

Palo Alto firewalls write a threat log whenever a security profile matches traffic against a signature. In CEF, the header says what kind of threat it was: the Device Event Class ID holds the subtype (vulnerability, spyware, virus, wildfire-virus, …) and the Name is THREAT. The act key says what the firewall did with the traffic.

This rule fires when the firewall matched an exploit, spyware or malware signature and stopped the traffic: drop, drop-all-packets, one of the reset actions, or block-ip.

Detection logic

Two selections, both required:

1. threat_match: a Palo Alto Networks event named THREAT whose subtype is vulnerability, spyware, virus or wildfire-virus. This captures every exploit, C2 and malware signature without listing signature names, so the rule keeps working when Palo Alto ships new signatures.
2. blocked: the action stopped the traffic. An alert action only logged it, and is deliberately not included.

The condition is threat_match and blocked. Traffic logs (Name TRAFFIC) never match.

Validated against a real sample

Validated against cef_firewall_attack.log (shipped with LogTriage), ten PAN-OS threat events in Palo Alto’s CEF layout. The rule fires on eight of them:

• Three SQL injection attempts (subtype vulnerability, action reset-both) from 185.220.101.45, including a UNION SELECT and a time-based SLEEP payload
• Four brute-force login attempts (subtype vulnerability, action block-ip) from 103.21.244.0 against /api/v1/auth/login
• One command-and-control match (subtype spyware, action reset-both) between 185.220.101.45 and the internal host 10.0.1.22 on port 4444

It does not fire on the zone-protection port scan (subtype scan) or the data-filtering event (subtype data); the FAQ explains why. It stays silent on cef_firewall_normal.log, which holds only TRAFFIC logs with the action allow: web, mail, DNS, internal API and monitoring traffic.

False positives

Genuine false positives are uncommon, because a match requires the firewall’s own signature engine to recognize attack traffic. The recurring case is sanctioned security testing: a vulnerability scanner or penetration test from a known source. Correlate matches with documented testing windows. Otherwise, treat a spyware match from an internal host as a real infection until proven otherwise.