• Custom vulnerability signatures fail to trigger on DHCP Release messages (type 7)

• Threat traffic matching the custom signature is not being correctly identified or blocked.

• Inconsistent signature matching performance when utilizing protocol-agnostic or 'udp-context-free' contexts.

• OS: PAN-OS

• Security Service: Threat Prevention

• Security Profile: Vulnerability Protection Profile

• Application: DHCP

• Diagnostic Tool: Packet Capture - Wireshark

• Incorrect Pattern Definition: A misconfiguration in the hexadecimal pattern string prevents the signature from accurately matching the target traffic.

• Improper Context Selection: Choosing an inappropriate or overly restrictive inspection context for the signature prevents the engine from successfully triggering on the specified packet fields.

To successfully build a custom vulnerability signature for detecting DHCP Release messages, use the following steps to choose the correct context and establish the pattern match:

1. Analyze the Packet Capture:

   • Open your packet capture and isolate the packet containing the DHCP Release message.

   • Examine the packet bytes to identify the specific fields that will trigger the detection.

2. Identify the following key byte sequences: 

   • 63 82 53 63: DHCP Magic Cookie (marks the start of the DHCP options field).

   • 35 01 07: Option 53, Length 1, Value = 7 (DHCP Message Type: Release).

   • 36 04: Option 54 (Server ID), length 4 (Beginning of the Server Identifier option).

    

    

3. Define Context and Pattern:

   • Based on your analysis, define the inspection context and the hexadecimal pattern required for the signature.

   • Context: dhcp-req-option-header

   • Pattern: \x63 82 53 63 35 01 07 36 04 0a 00 01 0a\x

4. Construct the Custom Signature XML:

   • Create the signature configuration by defining a unique Threat ID and the required logical conditions (AND/OR).

   • Use the following XML structure for the implementation:

<vulnerability-threat version="11.2.0">

  <entry name="41111">

    <signature>

      <standard>

        <entry name="Try dhcp">

          <and-condition>

            <entry name="And Condition 1">

              <or-condition>

                <entry name="Or Condition 1">

                  <operator>

                    <pattern-match>

                      <pattern>\x63 82 53 63 35 01 07 36 04 0a 00 01 0a\x</pattern>

                      <context>dhcp-req-option-header</context>

                      <negate>no</negate>

                    </pattern-match>

                  </operator>

                </entry>

              </or-condition>

            </entry>

          </and-condition>

          <order-free>no</order-free>

          <scope>protocol-data-unit</scope>

        </entry>

      </standard>

    </signature>

    <default-action>

      <alert/>

    </default-action>

    <threatname>dhcp test</threatname>

    <severity>informational</severity>

    <direction>client2server</direction>

    <affected-host>

      <client>yes</client>

    </affected-host>

  </entry>

</vulnerability-threat>

Create a Custom Threat Signature

String Contexts