PaloAltoNetworks/WireLurkerDetector

This repository has been archived on 16/Aug/2022
Stars
412
Rank 105,024 (Top 3 %)
Language
Python
License
ISC License
Created about 10 years ago
Updated about 2 years ago

PaloAltoNetworks/WireLurkerDetector

PaloAltoNetworks

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Script for detecting the WireLurker malware family

WireLurker Detector

Description

This project provides script and/or tool to detect the WireLurker malware family found by Palo Alto Networks in Nov 2014.

For details of the WireLurker:

Usage for OS X users

Open the Terminal application in your OS X system;
Execute this command to download the script:

curl -O https://raw.githubusercontent.com/PaloAltoNetworks/WireLurkerDetector/master/WireLurkerDetectorOSX.py

Run the script in the Terminal:

python WireLurkerDetectorOSX.py

Read the output messages and detection result.

For Windows users

We described how to technically detect the Windows variant of WireLurker in this document: HOWTO-Windows.md . Please take a look at it if you would like to contribute on it.

Here are some Windows detection tools developed by others. Remember to thanks them!

https://github.com/ltfish/WireLurkerCleaner by ltfish
https://github.com/kaustubhsant/WireLurkerDetector by kaustubhsant

Issues

For any issue on the code and its result, please create a issue here: https://github.com/PaloAltoNetworks/WireLurkerDetector/issues

docusaurus-openapi-docs

🦝 OpenAPI plugin for generating API reference docs in Docusaurus v3.

minemeld

Main MineMeld documentation repo

pan-os-python

The PAN-OS SDK for Python is a package to help interact with Palo Alto Networks devices (including physical and virtualized Next-generation Firewalls and Panorama). The pan-os-python SDK is object oriented and mimics the traditional interaction with the device via the GUI or CLI/API.

rbac-police

Evaluate the RBAC permissions of Kubernetes identities through policies written in Rego

ansible-pan

Ansible modules for Palo Alto Networks NGFWs

pan-os-ansible

Ansible collection for easy automation of Palo Alto Networks next generation firewalls and Panorama, in both physical and virtual form factors.

iron-skillet

IronSkillet is a set of day-one configuration templates for PAN-OS to enable alignment with security best practices. See the Quick Start section below to get started using the template configurations.

minemeld-core

Engine of MineMeld

terraform-templates

This repo contains Terraform templates to deploy infrastructure on AWS and Azure and to secure them using the Palo Alto Networks Next Generation Firewalls

ansible-playbooks

Sample playbooks for the Palo Alto Networks Ansible modules.

azure

VM-Series ARM Templates for Microsoft Azure

Splunk-Apps

Palo Alto Networks App for Splunk leverages the data visibility provided by Palo Alto Networks next-generation firewalls and endpoint security with Splunk's extensive investigation and visualization capabilities to deliver an advanced security reporting and analysis tool.

IAM-Deescalate

IAM-Deescalate helps mitigate privilege escalation risk in AWS identity and access management (IAM)

terraform-provider-panos

Terraform Panos provider

prisma-cloud-policies

PCS Policies Release Notice

prisma-cloud-docs

Prisma Cloud docs

aws

VM-Series for Amazon Web Services

prisma_channel_resources

A collection of technical and sales resources related to Prisma Cloud Compute and Prisma Cloud Enterprise created for the PANW Channel Partner Ecosystem and other engineers working with the solution

pcs-postman

Postman collections for Prisma Cloud

aws-elb-autoscaling

Auto Scaling VM-Series firewalls in AWS

pan-os-php

Framework and utilities to easily manage and edit Palo Alto Network PANOS devices

terraform-provider-prismacloud

Terraform PrismaCloud provider

Prisma-Enhanced-Remediation

Create custom auto-remediation solutions using serverless functions in the cloud.

pango

pango is the underlying library for the Palo Alto Networks Terraform provider

pyjarm

pyJARM is a library for doing JARM fingerprinting using python

AWS-GWLB-VMSeries

This repository contains CFT and TF templates for deploying VM-Series Firewalls behind AWS Gateway Load Balancer

minemeld-ansible

Ansible playbook for installing MineMeld on Linux

can-ctr-escape-cve-2022-0492

Test whether a container environment is vulnerable to container escapes via CVE-2022-0492

prisma-cloud-scan

GitHub action to scan container images with Palo Alto Networks' Prisma Cloud

prismacloud-api-python

Prisma Cloud utility scripts, and a Python SDK for Prisma Cloud APIs.

pan-cortex-data-lake-python

Python idiomatic SDK for Cortex™ Data Lake.

InstallerHijackingVulnerabilityScanner

research-notes

terraform-azurerm-vmseries-modules

Terraform Reusable Modules for VM-Series on Azure

aws-transit-vpc

automated AWS transit vpc

panhandler

Panhandler is a tool to manage config snippets and Skillets for PAN-OS devices

minemeld-webui

WebUI of MineMeld

pan.dev

Palo Alto Networks for Developers

pcs-sizing-scripts

Prisma Cloud sizing scripts

minemeld-node-prototypes

Prototypes for MineMeld nodes

TransitGatewayDeployment

Creates a Transit Gateway with two server VPCs and a security VPC

terraform-aws-vmseries-modules

Terraform Reusable Modules for VM-Series on AWS

Kubernetes

Repository for Palo Alto Networks Kubernetes Security - CN Series.

ReferenceArchitectures

Palo Alto Networks Reference Architectures

evident-custom-signatures

Evident Security Platform Custom Signatures Samples

pan-fca

Flexible Cloud Automation

prismacloud-cli

The Prisma Cloud CLI is a command line interface for Prisma Cloud by Palo Alto Networks.

terraform-best-practices

A set of best practices to be followed when contributing to the Palo Alto Networks terraform modules

report_to_misp

Parse a report and import the events into MISP

tg

Certificate generation made easy

autofocus-lenz

A command line utility to aid in using autofocus for IR and research

azure-applicationgateway

Scale out security for web deployments using VM-Series firewalls and Azure Application Gateway web load balancer

prisma-cloud-compute-sample-code

Example scripts, snippets, and other documents related to Prisma Cloud Compute

Open Policy Agent

lab-aws-gwlb-vmseries

Materials for PS Regional Training AWS lab

terraform-provider-prismacloudcompute

Terraform provider for Prisma Cloud Compute

gaia

Aporeto API (Elemental model)

cobra-tool

Cloud Offensive Breach and Risk Assessment (COBRA) Tool

prisma.pan.dev

The home of Developer docs for Prisma by Palo Alto Networks

Azure-Transit-VNet

Azure security with VM-Series in a hub-and-spoke architecture

pan-stix

minemeld-misp

MineMeld nodes for MISP

autofocus-client-library

A python client library for interfacing with the autofocus rest services

openstack-templates

VM-Series Firewalls on OpenStack

Rich Text Format

Splunk_TA_paloalto

The Palo Alto Networks Add-on for Splunk allows a Splunk® Enterprise or Splunk Cloud administrator to collect data from Palo Alto Networks Next-Generation Firewall devices and Advanced Endpoint Protection.

azure-autoscaling

Azure autoscaling solution using VMSS

regolithe

Regolithe Specifications + Dev Tools

elemental

Go library implementing the Regolithe specifications as Elemental model

tcpsession

A python library to extract TCP sessions from PCAPs.

prisma-cloud-best-practices

Prisma Cloud best practice documentation and guides

GCP-Terraform-Samples

This repository is deprecated

manipulate

Go library to perform CRUD operations on an Elemental model with multiple backend implementations

minemeld-docker

Official Palo Alto Networks MineMeld docker

cn-series-deploy

A set of Terraform plans for deploying a Kubernetes cluster protected by a CN-Series containerize firewall

prisma-cloud-compute-operator

prisma-cloud-go

Prisma Cloud SDK in Go

multicloud-automation-lab

Multi-Cloud Security Automation Lab

pantools

A collection of pre-installed tools commonly used with Palo Alto Networks products packaged as a Docker container

terraform-provider-cloudngfwaws

The Terraform provider for the Palo Alto Networks AWS cloud NGFW

terraform-ansible-intro

Introduction to Terraform and Ansible

terraform-google-vmseries-modules

Terraform Reusable Modules for VM-Series on Google Cloud Platform (GCP)

wsc

wsc is a library that allows to interact with web sockets using channels.

cn-series-helm

This repo is for deploying CN-series firewall using Helm Package Manager for Kubernetes

aws-alb-sandwich

AWS ALB Sandwich with VM-Series

cis-benchmarks

CIS benchmark quickplay for rapid assessments of the NGFW

SafeNetworking

Read only mirror. To contribute or submit issues, please go to the website link --->

misp-to-autofocus

Script for pulling events from a MISP database and converting them to Autofocus queries.

Prisma-Cloud-DevOps-Security

gcp-two-tier

VM-Series templates for Google Cloud Platform

pcs-serverless-syslog

Prisma Cloud serverless function that can accept webhook and send alerts to syslog, S3, and SQS

mtlsproxy

Simple mtls HTTPs proxy to use as a sidecar for protecting non critical services

youtube-miner

MineMeld Miner for Youtube channels

terraform-provider-prismacloud-orig

Terraform provider for Prisma Cloud

HomeSkillet

Simple 2-zone internet gateway configuration for home use

pancloud-nodejs

Palo Alto Networks Application Framework NodeJS SDK

panos-bootstrapper

A Utility to bootstrap a new PAN-OS NGFW. This utility provides an API only. An example web interface is provided here: https://github.com/PaloAltoNetworks/panos-bootstrapper-ui

prisma-access-skillets

Suite of skillets for initial Prisma Access deployment and configuration

panos-bootstrapper-ui

PAN-OS Bootstrapper UI provides a simple, example web-UI that consumes the PAN-OS Bootstrapper utility API.

terraform-iac-lab

Infrastructure as Code lab using Terraform and GCP

pan-threat-vault-python

Python interface to the Palo Alto Networks Threat Vault API

azure-terraform-vmseries-fast-ha-failover

Azure Load Balancer and HA Combined Deployment for Faster Failover with no API Calls