Palo Alto Content Updates - version 9016 of the Applications and Threats content update

Changes in version 9016 of the Applications and Threats content update, which includes new App-IDs, vulnerability signatures, and other threat-related information.

Key Points & Best Practices

• New App-IDs and changes are often released as Threat Signature Indicators (TSIDs) first, allowing users to prepare before they are officially activated in a future content update.

• You can now check the coverage status of upcoming CVEs (Common Vulnerabilities and Exposures) directly through Threat Vault.

• The update disables Anti-Spyware signature #21051 to resolve performance issues.

---

Upcoming Changes (Intended for September 16, 2025)

• App-ID Expansion: Coverage will be expanded for several App-IDs, including naver-ndrive to cover NAVER MyBOX traffic, and snmp-base to cover Dell PowerScale SNMP traffic. The liveperson and whatsapp-base App-IDs will also be expanded to cover their respective homepages.

• New App-IDs: Several new ICS, IoT, and OT App-IDs will be introduced, such as ifm-vision-discovery and beijer-ix-hmi.

• Reduced Coverage: The ms-office365-copilot App-ID will have its coverage reduced to prevent false positives by no longer identifying non-Copilot traffic like Outlook Spellcheck.

• New URL Category: The Compromised-Website URL category will be activated, with the recommended default action being "Block."

---

New & Modified Signatures

• New Anti-Spyware Signatures: Two new signatures have been added, one for a critical backdoor and another for a high-severity webshell.

• New Vulnerability Signatures: 19 new vulnerability signatures have been added, with a majority being critical-severity issues related to buffer overflows and remote code execution in various products like Tenda, Microsoft SharePoint, and Cisco.

• Modified Signatures: Four vulnerability signatures have been updated with improved detection logic to either cover new exploits or address potential false positives. 12 other signatures have been updated with changes to their metadata information.

• Disabled Signature: Anti-Spyware signature #21051, which detects Emotet downloader traffic, has been disabled due to performance issues.

Palo Alto Networks Applications and Threats Content Release Notes" for Version 8999

 

Details of this Update (Version 8999)

This update focuses heavily on App-ID expansions and refinements, along with new vulnerability and anti-spyware signatures. Key aspects include:

1. App-ID Enhancements (Final Reminders for August 19, 2025 Activation):

• Soti MobiControl: Expanding coverage for additional connections to Soti XSight server, currently identified as ssl.

• MS-RDP: Expanding coverage for RDP traffic from Microsoft Defender's Network Name Resolution, currently identified as ssl.

• Cortex-XDR: Activating enhanced coverage for global-content-profiles-policy.storage.googleapis.com traffic, currently identified as traps-management-service. (TSIDs for this were introduced in version 8990).

• GitHub-Base: Expanding coverage for github.dev traffic, currently identified as web-Browse and ssl.

• SaaS App-ID Risk Scores: Intention to update risk scores for many SaaS App-IDs, specifically those currently at '5'.

• SaaS Characteristic Update: Intention to update the 'SaaS' characteristic from 'no' to 'yes' for many App-IDs.

• New SaaS Characteristic "Uses GenAI to Generate Code": Introduction of a new characteristic to identify applications that use Generative AI for code creation. This will first be for Content App-IDs (scheduled for July 15, 2025), with corresponding Cloud App-IDs getting it on August 19, 2025.

• New ICS, IoT, and OT App-IDs: Introduction of TSIDs for several new industrial control system, IoT, and operational technology App-IDs (e.g., advantech-adam-ascii, capsule-mdip-axon, emerson-movicon, etc.), with activation planned for August 19, 2025.

• New App-IDs: General intent to release new App-IDs and encourages using TSIDs, "New App-ID" application filters, or "Web App Tag" application filters for adoption.

• Foundation-Fieldbus: Activation of this new ICS, IoT, and OT App-ID (TSIDs for this were released in version 8990).

• New IP Geolocation Region: Introduction of "XK" for Kosovo.

2. Signature Updates:

• New Vulnerability Signatures (11): Includes critical and high-severity vulnerabilities like:

  • TOTOLINK A3700R SetLanguageCfg Stack Overflow (CVE-2024-22660) - Critical

  • Sudo Heap Overflow (CVE-2021-3156) - High

  • Curl NSS CERTINFO Denial-of-Service (CVE-2022-27781) - High

  • Glibc getaddrinfo Buffer Overflow (CVE-2015-7547) - High

  • Apache Kafka Arbitrary File Read (CVE-2025-27817) - High

  • Google Chrome Type Confusion (CVE-2025-6554) - High

  • Mozilla Multiple Products Out-Of-Bounds Write (CVE-2025-4918) - High

  • NI FlexLogger usiReg URI File Parsing Directory Traversal (CVE-2025-2449) - High

• Modified Anti-Spyware Signatures (1): Improved detection logic for "Grandoreiro Command and Control Traffic Detection" (critical, 86302) to address a possible false positive issue.

• Modified Vulnerability Signatures - Detection Logic (4): Improved detection logic for vulnerabilities including:

  • Ivanti Endpoint Manager Mobile Remote Code Execution (CVE-2025-4427, CVE-2025-4428) - High (new exploit coverage)

  • Windows Command No-banner Shell Access (medium, possible false positive fix)

  • Microsoft Browser Information Disclosure (CVE-2016-3298) - Medium (new exploit coverage)

  • Pandora FMS chromiumpath and phantomjsbin Command Injection (CVE-2024-12971) - Medium (possible false positive fix)

Issues (Potential)

Based on the content of the update, here are some potential issues for administrators:

• Policy Impact from App-ID Changes:

  • "SaaS Characteristic" Changes: If you use Application Filters with the "SaaS" characteristic, updating this content will change how some applications are classified. This requires review before the update or a later content version to prevent unexpected policy enforcement or blocking.

  • New App-IDs: The introduction of many new App-IDs, especially for ICS, IoT, and OT, means traffic previously identified as generic (e.g., ssl, web-Browse, unknown) might now be specifically identified. If your security policies rely on broader classifications for this traffic, you might need to adjust rules to permit or block the newly identified applications.

  • Traffic Reclassification: The specific reclassification of ssl traffic to soti-mobicontrol, ms-rdp, github-base could cause issues if your policies were explicitly allowing or denying ssl for these services without considering the underlying application.

• UI Issues with ACE and GenAI Characteristic: Customers with ACE (Application Command Explorer) are highly recommended to install the July 15, 2025 content version (which introduces the GenAI characteristic for Content App-IDs) before the August 19, 2025 update to prevent a UI issue. This indicates a potential dependency or incompatibility if not followed.

• False Positives/Negatives (Temporary): While improvements are aimed at reducing false positives (e.g., Grandoreiro, Windows Command Shell Access, Pandora FMS), any change in signature logic always carries a small risk of temporary false positives or, less commonly, false negatives until the update settles in the environment.

• Performance Impact: A large number of new and modified signatures, especially for App-IDs, can sometimes have a minor, temporary performance impact during initial deployment or if the firewall is heavily loaded. This is generally mitigated by modern Palo Alto Networks devices.

• Compatibility: While the "Minimum PAN-OS Version" is listed for vulnerability signatures (e.g., 8.1.0, 11.1), it's crucial to ensure your PAN-OS version is compatible with this content update. Older PAN-OS versions might not fully support all new App-IDs or signature capabilities.

Prognosis

The overall prognosis for this content update is positive for security posture improvement, but it requires proactive management and review by administrators.

• Enhanced Visibility and Control: The expanded App-ID coverage, particularly for Soti, RDP, Cortex XDR, GitHub, and numerous ICS/IoT/OT protocols, will provide much finer-grained visibility into network traffic. This allows for more precise security policies, moving away from generic ssl or web-Browse rules.

• Improved Threat Detection: The significant number of new and modified vulnerability and anti-spyware signatures directly enhances the firewall's ability to detect and prevent known exploits and command-and-control activity. The fixes for false positives are also beneficial for reducing alert fatigue.

• Better SaaS Management: The risk score updates and the new "SaaS" characteristic will aid organizations in better understanding and managing their SaaS application usage from a security perspective. The "Uses GenAI to Generate Code" characteristic is forward-looking and will be increasingly valuable for governing AI-powered development tools.

• Planning is Key: Due to the "Final Reminder" nature, Palo Alto Networks is giving a clear signal that these changes are coming. This provides administrators with time to:

  • Review existing policies: Specifically, check application filters that use the "SaaS" characteristic.

  • Prepare for new App-IDs: Consider how newly identified applications (especially ICS/IoT/OT) will interact with your current security policies.

  • Prioritize updates: Given the critical and high-severity vulnerability fixes, deploying this update in a timely manner is important.

  • Adhere to the ACE recommendation: Ensure the July 15, 2025 content update is installed for ACE users before August 19, 2025.

In summary, Content Update 8999 is a substantial update that significantly enhances Palo Alto Networks' ability to identify applications and detect threats. The "Final Reminder" indicates a strong push towards these changes being live soon, necessitating careful planning and policy review to ensure a smooth transition and maximize security benefits.

Palo Alto Networks Content Update (version 8969)

Palo Alto Networks Content Update (version 8969) informs about upcoming changes to application and threat identification features in their security products.

Key points include:

• Introduction of Threat Signature Indicators (TSIDs): Palo Alto Networks will continue to introduce new and modified App-IDs as TSIDs, allowing users to prepare before they are fully activated in later content updates.
• Upcoming Activations (May 20, 2025): Several new functional App-IDs, previously introduced as TSIDs, will be activated for:
  • Jira (SSL decryption required)
  • Microsoft Teams (SSL decryption required)
  • National Transportation Communications for Intelligent Transportation System (ITS) Protocol (NTCIP)
• New TSIDs and Future Activation (June 17, 2025): New TSIDs will be introduced for:
  • Microsoft SharePoint Online (activation on June 17, 2025, SSL decryption required)
  • Enhanced Webex joining identification (activation on June 17, 2025, no SSL decryption required)
  • Enhanced Modbus over UDP identification (activation on June 17, 2025, no SSL decryption required)
  • Miracast over Infrastructure Connection Establishment (ms-mice) (activation on June 17, 2025, no SSL decryption required)
  • Enhanced Plex browser streaming traffic identification (activation on June 17, 2025, no SSL decryption required)
  • Enhanced Cortex XDR traffic identification to global-content-profiles-policy.storage.googleapis.com (activation on June 17, 2025, no SSL decryption required)
• dtls App-ID Modifications:
  • The dtls App-ID will become a dependent App-ID for cisco-spark-audio-video and rtp-base in PAN-OS 11.0+ (recommend adding dtls to security policies).
  • New TSIDs for PAN-OS 11.0+ will reduce dtls coverage to fix over-coverage (activation on June 17, 2025).
  • The modified dtls App-ID for detecting DTLS within STUN in PAN-OS 10.2 and earlier will be activated (recommend adding dtls and/or stun to policies allowing related App-IDs).
• Other Changes:
  • Fix for linkedin-mail identification.
  • Enhanced coverage for zscaler-internet-access App-ID (recommend adding to policies if Zscaler is used).
  • Updated category/subcategory for adobe-echosign.
  • Updated risk scores for more SaaS App-IDs.
• Reminders of Previous Updates (April 16, 2025): Activation of Google Compute Engine, Jira, Microsoft Teams, Tableau AI, and Slack App-IDs; expanded coverage for FTP and Ring; updated SaaS App-ID risk scores; and a fix for WildFire Inline ML models in the CLI.
• Decoder and Signature Updates: Includes changes to FTP, HTTP, HTTP2, and MB-8-1 decoders, a new EML file type, and improved detection logic for several vulnerability signatures.
• Region Code Deprecation: The planned deprecation of A1 and A2 region codes is under further research.

In essence, this update provides administrators with advance notice of changes to Palo Alto Networks' application and threat identification capabilities, allowing them to prepare their security policies for these updates to maintain effective traffic control.