Modern Malware Protection

Modern attackers have increasingly turned to targeted and new unknown variants of malware in order sneak past traditional security solutions. To address this change in the threat landscape, Palo Alto Networks has developed WildFire, which provides the ability to identify new malware in minutes by executing suspect files in a virtual environment and observing their behaviors. This enables Palo Alto Networks to identify malware quickly and accurately, even if the particular sample of malware has never been seen in the wild before.

Once a file is determined to be malicious, WildFire automatically generates protections, which are delivered to all WildFire subscribers within an hour of initial detection. WildFire with the WildFire license Your IT team is provided with a wealth of forensics to see exactly who was targeted, the application used in the delivery and any URLs that played a part in the attack.

	Sandbox analysis of unknown threats. Network attacks are increasingly driven by sophisticated malware that is designed to avoid traditional antivirus controls. WildFire extends the next-generation firewall to identify and block targeted and unknown malware by actively analyzing unknown malware in a safe, cloud-based virtual environment, where Palo Alto Networks can directly observe malicious malware behaviors. WildFire automatically generates protections for newly discovered malware, and delivers these protections globally, enabling all customers to benefit from the analysis.
	DNS-based botnet signatures. Malware networks are always in flux as the bot-masters use new URLs to obscure the true destination of their command and control infrastructure. To address this challenge, Palo Alto Networks passively analyzes DNS queries to identify and block command-and-control messages from botnet-infected hosts on the network.
	Behavioral botnet report. The behavioral botnet report correlates traffic anomalies and end-user behaviors to identify devices on the network that are likely infected by a botnet. The logic supporting the report tracks unknown or anomalous TCP and UDP as well as a variety of potentially suspicious behaviors such as repeated download patterns, the use of dynamic DNS and browsing anomalies. These factors are correlated to deliver a report that provides you with a list of users that are likely infected and the behaviors that led to the diagnosis.