What are the Inline Cloud Analysis C2 Threat IDs?
Question
What are the Inline Cloud Analysis Threat IDs?
Environment
- Next Gen Firewalls (NGFW)
- PanOS 10.2 and above
Answer
Threat ID - Threat Name - Protocol/Tool
89950 - Evasive HTTP C2 Traffic Detection - HTTP
89951 - Inline Cloud Analyzed HTTP2 Command and Control Traffic Detection - HTTP2
89952 - Inline Cloud Analyzed SSL Command and Control Traffic Detection - SSL/TLS Handshake
89953 - Inline Cloud Analyzed Unknown-TCP Command and Control Traffic Detection - Unknown TCP
89954 - Inline Cloud Analyzed Unknown-UDP Command and Control Traffic Detection - Unknown UDP
89955 - Evasive Cobalt Strike C2 Traffic Detection - Cobalt Strike
89956 - Evasive Cobalt Strike C2 Traffic Detection - Cobalt Strike
89957 - Evasive Cobalt Strike C2 Cross Session Traffic Detection - Cobalt Strike
89958 - Evasive Empire C2 Traffic Detection - Empire
89959 - HTTP Data Exfiltration via FQDN Using Suspicious Domain - HTTP
89960 - HTTP2 Data Exfiltration via FQDN Using Suspicious Domain - HTTP2
PanOS:11.2
89961 - Evasive Sliver C2 Traffic Detection - Sliver