Information
Disable WMI probing if it is not required for User-ID functionality in the environment.
Rationale:
WMI probing normally requires a domain administrator account. A malicious user could capture the encrypted password hash for offline cracking or relayed authentication attacks. Relying on other forms of user identification, such as using UserID Agents or security log monitoring, mitigates this risk.
In addition, it is easy to mis-configure this feature such that it is enabled on untrusted interfaces. This can result in a domain administrator account and the associated password hash being sent to untrusted hosts on the internet, where malicious users can then capture that hash for offline cracking.
Solution
Navigate to Device > User Identification > User Mapping > Palo Alto Networks User ID Agent Setup.
Set Enable Probing so it is unchecked.
Impact:
While this removes the exposure of having the WMI user account password being compromised, it also reduces the effectiveness of user identification during operation of the firewall (applying rules and policies). This trade-off should be weighed carefully for all installations.
Default Value:
Not configured
References:
'R7-2014-16: Palo Alto Networks User-ID Credential Exposure' - https://blog.rapid7.com/2014/10/14/palo-alto-networks-userid-credential-exposure/
'Best Practices for Securing User-ID Deployments' - https://live.paloaltonetworks.com/docs/DOC-7912
'PAN-OS Administrator's Guide 9.0 (English) - Client Probing' - https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/user-id/user-id-concepts/user-mapping/client-probing