Why is Anti-Spyware rule by Threat Name filter not working as expected when using 'C2' or 'C2 traffic' for the threat name.

• Palo Alto NGFW Firewall
• Supported PAN-OS
• Anti Spyware

1. Check to see if the C2 traffic signature is autogenerated. You can view this by going to https://threatvault.paloaltonetworks.com, searching for the signature then clicking on the name link. 

2. Looking under the category field will show you if the signature is an autogenerated spyware signature ('autogen').

NOTE
Currently, automatically generated antispyware signatures are not able to be matched by a 'Threat name' filter/condition when creating a category policy under Antispyware Profile.
To set up a special category policy for C2 traffic with autogen signatures, you will need create it with "Category" set to "autogen" and "Threat Name" set to "any" (blank), as shown in the screenshot below:
 

Note: if this is in an Antispyware Profile with other categories, like the example above, make sure it is the top category in the list as shown in the example.