Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Extending Auto Focus Threat Intelligence With New Tag Types

Summary: Palo Alto Networks released AutoFocus version 1.0.7, which adds tag classes so responders can distinguish Malware Family and Campaign tags from internal intelligence versus Unit 42 research. The release also introduces a Malicious Behavior tag class, which is behavior-based and can flag samples lacking a Malware Family tag, including benign samples exhibiting questionable behavior.

Key Takeaway: Malicious Behavior tags cover actions like disabling the Windows Firewall, deleting Shadow Copies, and reading the local SAM database - the moves ransomware and advanced actors make before you have a signature for their sample.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026