Exam NetSec-Analyst Topic 1 Question 102 Discussion

This question targets advanced custom signature creation, specifically focusing on TLS handshake details. The key is detecting a pattern within the 'TLS Client Hello extension'. Signature Type: Custom Threat - This is the general category for detecting specific malicious patterns not covered by pre-defined signatures. While 'Vulnerability' or 'Spyware' could potentially be used for broader malware, 'Custom Threat' is designed for specific, targeted threat detection. Location: 'ssl-client-hello-extensions' - This is the crucial part. Palo Alto Networks custom signatures offer specific 'Locations' to target different parts of network protocols. To inspect details within the TLS Client Hello extensions , the 'ssl-client-hello-extensions' location is the precise target. 'ssl-client-hello' would match the entire Client Hello, but 'ssl-client-hello-extensions' provides a more granular context for patterns specifically within the extensions field, which is what the problem describes. Let's review other options: A. Signature Type: Vulnerability, Location: 'tcp-payload' : 'tcp-payload' is too broad; it inspects the entire TCP payload, which would be inefficient and prone to false positives if the pattern is specific to TLS handshake elements. 'Vulnerability' is generally for exploits. B. Signature Type: Spyware, Location: 'ssl-client-hello' : While 'ssl-client-hello' is closer, it's less specific than 'ssl-client-hello-extensions' if the goal is to target patterns within the extensions. 'Spyware' is a valid threat category, but the location precision is important here. D. Signature Type: DoS, Location: 'tls-handshakes : DoS signatures are for denial-of-service attacks. 'tls-handshake' is a valid location but 'ssl-client-hello-extensions' is even more granular and accurate for the specific problem. E. Signature Type: Protocol Anomaly, Location: 'http-request-headers' : Protocol Anomaly signatures detect deviations from RFCs. 'http-request-headers' is for HTTP headers, not TLS handshake details.