PANW Firewall Traffic to Malicious URL Allowed
Detects when the Palo Alto Networks firewall does not block traffic to a URL associated with malware distribution or operation. This typically indicates a lapse in the firewall's threat intelligence or a misconfiguration. An adversary can abuse this by using the unblocked URL to download malware onto a target system, establish a command and control channel, or exfiltrate data.
Splunk (SPL)
