PANW-AG-000036 - The Palo Alto Networks security platform must disable WMI probing if it is not used.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

User-ID can use Windows Management Instrumentation (WMI) probing as a method of mapping users to IP addresses. If this is used, the User-ID Agent will send a probe to each learned IP address in its list to verify that the same user is still logged in. The results of the probe will be used to update the record on the agent and then be passed on to the firewall. WMI probing is a Microsoft feature that collects user information from Windows hosts, and contains a username and encrypted password hash of a Domain Administrator account.

WMI probing on external/untrusted zones can result in the User-ID agent sending WMI probes to external/untrusted hosts. An attacker can capture these probes and obtain the username, domain name and encrypted password hash associated with the User-ID account. If WMI probing is not used as a method of user to IP address mapping, it must be disabled.

Solution

To disable WMI probing if it is not used:
Go to Device >> User Identification
On the 'User Mapping' tab, in the 'Palo Alto Networks User ID Agent' pane, view the 'Enable Probing' check box.
If it is selected, select the 'Edit' icon in the upper-right corner of the pane.
In the 'Palo Alto Networks User ID Agent Setup' window, in the 'Client Probing' tab, deselect the 'Enable Probing' check box.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_PAN_Y24M07_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000381, Rule-ID|SV-228838r557387_rule, STIG-ID|PANW-AG-000036, STIG-Legacy|SV-77049, STIG-Legacy|V-62559, Vuln-ID|V-228838

Plugin: Palo_Alto

Control ID: 1936764897925a56360583578e4a28d7b45a01d808b60263cf0686cb4cf7e32b