The Anti-Spyware Security Profile is specifically designed to detect and block malicious traffic from compromised hosts. This includes identifying attempts by malware to communicate with external command-and-control (C2) servers. The profile uses signatures to recognize C2 traffic patterns, malicious DNS queries, and other indicators of a compromised system attempting to "phone home." By applying an Anti-Spyware profile with an action of block or reset to outbound Security policy rules, an administrator can prevent the C2 connection from being established, effectively neutralizing the threat's ability to receive commands or exfiltrate data.

A. Antivirus Profile: This profile focuses on blocking malware-infected files during transfer, not the subsequent C2 network traffic generated by an already infected host.

B. Data Filtering Profile: This profile is used to prevent the exfiltration of sensitive data patterns (e.g., credit card numbers), not to block C2 communication channels.

C. Vulnerability Protection Profile: This profile protects against attempts to exploit software vulnerabilities to compromise a host, which is a pre-infection measure, not a post-infection C2 block.

---

1. Palo Alto Networks

"PCNSA Study Guide

" Version 10.1

(2021).

Page 158

"Anti-Spyware Profiles": "Anti-spyware profiles block spyware from compromising a host and document any compromised hosts on the network. Spyware can include malware

grayware

and remote access tools that are used for malicious purposes

such as data theft and generating command-and-control (C2) traffic."

2. Palo Alto Networks

"PAN-OS® Administrator’s Guide

" Version 10.2

(2022).

Section: "Threat Prevention > Anti-Spyware": "The Anti-Spyware profile detects spyware on compromised hosts... When a compromised host tries to communicate with a C2 server

the firewall can identify the traffic based on C2 signatures and block the session."

3. Palo Alto Networks

"PAN-OS® Administrator’s Guide

" Version 10.2

(2022).

Section: "Threat Prevention > Antivirus": "The Antivirus profile scans for a wide range of malware

such as viruses

worms

and trojans

in traffic." This confirms its focus is on the malware file itself

not its network behavior.