[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/findpos-new-pos-malware-family-discovered/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/findpos-new-pos-malware-family-discovered/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/ "Threat Research")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# FindPOS: New POS Malware Family Discovered

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 10 min read  
Related Products  
[![Advanced WildFire icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced WildFire](https://unit42.paloaltonetworks.com/product-category/advanced-wildfire/ "Advanced WildFire")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:March 19, 2015

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [FindPOS](https://unit42.paloaltonetworks.com/tag/findpos/)
  * [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/)
  * [Point of Sale](https://unit42.paloaltonetworks.com/tag/point-of-sale/)
  * [Windows](https://unit42.paloaltonetworks.com/tag/windows/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/findpos-new-pos-malware-family-discovered/?pdf=download&lg=en&_wpnonce=7c3dfffa8c "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/findpos-new-pos-malware-family-discovered/?pdf=print&lg=en&_wpnonce=7c3dfffa8c "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](mailto:?subject=FindPOS:%20New%20POS%20Malware%20Family%20Discovered&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ffindpos-new-pos-malware-family-discovered%2F "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffindpos-new-pos-malware-family-discovered%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffindpos-new-pos-malware-family-discovered%2F&title=FindPOS:%20New%20POS%20Malware%20Family%20Discovered "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffindpos-new-pos-malware-family-discovered%2F&text=FindPOS:%20New%20POS%20Malware%20Family%20Discovered "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2Ffindpos-new-pos-malware-family-discovered%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](https://mastodon.social/share?text=FindPOS:%20New%20POS%20Malware%20Family%20Discovered%20https%3A%2F%2Funit42.paloaltonetworks.com%2Ffindpos-new-pos-malware-family-discovered%2F "Share in Mastodon")
  Unit 42 has discovered a new Point of Sale (POS) malware family, which includes multiple variants created as early as November 2014. Over the past few weeks we have been analyzing this malware family, which we have dubbed 'FindPOS' due to strings consistently found in each variant.

While this malware doesn't show strong sophistication, the large number of variants shows prevalence similar to families such as [Alina](https://www.trustwave.com/Resources/SpiderLabs-Blog/Alina--Following-The-Shadow-Part-1/) and [Backoff](https://www.trustwave.com/Resources/SpiderLabs-Blog/Backoff---Technical-Analysis/). It is clear that FindPOS should be considered a strong threat to Microsoft Windows POS vendors, and measures should be taken to ensure protection.

### Workflow

The malware in question has the ability to scrape memory for [track data](https://en.wikipedia.org/wiki/Magnetic_stripe_card), exfiltrate any discovered data via HTTP POST requests, and in some instances log keystrokes. While the malware family uses many common techniques witnessed in previous malware families targeting POS devices, the prevalence and continued development of this malware demonstrates a threat to those running Windows-based point of sale terminals.

The general workflow of the FindPOS malware family can be seen below.

[![workflow\_pos](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/workflow_pos-500x274.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/workflow_pos.png)

### Evolution

Over the course of our research, a total of nine variants of FindPOS have been discovered. Using compile timestamp information, we can see a timeline of these variants below.

[![Timestamps\_pos](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/Timestamps_pos-500x405.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/Timestamps_pos.png)

A breakdown of the specific functionality changes between versions is as follows:

**Version 2.1**

* Modified hashing algorithm to use the following information:
  * Volume Serial Number
  * Networking Adapters (IPv4 Only)
* Added 'uinfo' POST parameter

**Version 5.57**

* Added ability to terminate previously installed FindPOS upon installation
* Code cleanup during install
* Set main thread to lowest priority
* Added memory scraping checks
  * Expiration year between 2014 and 2030
  * Expiration month between 1 and 12
  * Service code set to either '101' or '201'
* Added ability to download/execute files
* Removed 'Cookie: income=1' HTTP Header
* Added User-Agent HTTP Header

**Version 5.80**

* Modified memory scraping checks
  * Expiration year cannot exceed 2030 (no lower bound check)
  * Expiration month cannot exceed 12 (no lower bound check)
* Code enhancements to domain/URI configuration

**Version 5.90**

* Added keylogging functionality

**Version 6.0**

* No significant changes identified

**Version 6.02**

* Minor modifications to exfiltration function

**Version 6.03**

* No significant changes identified

**Version 6.04**

* Minor modifications to exfiltration sleep timer

As we can see from the above timeline, FindPOS appears to have been very actively developed early on, while over time the author made minimal changes. These minimal changes were likely made for performance reasons or potentially bug fixes.

### Installation

Upon execution, FindPOS will generate a lowercase alphabetic executable name of eight characters (example: abodeign.exe). This name is generated using the following system information:

* C:\\ Volume Serial Number
* SystemBiosdate
* VideoBiosdate
* CPU Identifier
* Microsoft Windows ProductId

Using these values in order to generate results in a consistently generated name when run on the same machine. Please note that the hashing algorithm used was modified in version 2.1. Please refer to the 'Evolution' section above for details.

This executable name is then compared against the original executable name of the running malware. Should those names not match, the malware will proceed to continue with its installation routine.

FindPOS proceeds to copy itself to the following directories using the executable name that was previously generated:

* %SystemRoot%\\System32\\\[name\].exe
* %USERPROFILE%\\\[name\].exe

Should these file copy operations prove successful, the malware will write the following registry keys:

* HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run \[name\] : %SystemRoot%\\System32\\\[name\].exe
* HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run \[name\] : %USERPROFILE%\\\[name\].exe

The malware will proceed to spawn a new instance of %SystemRoot%\\System32\\\[name\].exe via a call to [CreateProcessA](https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425%28v=vs.85%29.aspx). Should this prove successful, the malware will execute the following command prior to exiting. This command is responsible for deleting the original executable.

*cmd.exe /c del \[original\_executable\_path\] \>\> NUL*

Should the CreateProcessA call on %SystemRoot%\\System32\\\[name\].exe fail, FindPOS will attempt to spawn a new instance of %USERPROFILE%\\\[name\].exe. If this proves successful, FindPOS will attempt to delete the original executable using the same technique previously seen.

After installation of FindPOS is successful, the malware will create a global mutex in order to ensure only one instance of FindPOS is running. This mutex has the following name:

* WIN\_\[hex\]

Where \[hex\] is a series of 16 uppercase hexadecimal characters that are generated using the same technique witnessed when generating the malware's executable name during the installation routine.

After this mutex is successfully created, FindPOS will continue to scrape memory and optionally log keystrokes.

### Memory Scraping

Memory scraping is a technique found in the majority of POS malware families discovered in prior years. The concept is fairly simple: read the memory of running processes on a POS terminal, and look for track data. When a card is swiped on a POS terminal, and the transaction is processed, the card data will often reside in memory unencrypted for a brief period of time. Attackers exploit this weakness in order to find track data.

A common technique for increasing performance of memory scrapers is to denylist a list of commonly seen process names, such as explorer.exe, lsass.exe, csrss.exe, etc. Alternatively, some malware families leverage an allowlist approach, where only specific process names are targeted. FindPOS, however, uses a brand new approach. This particular family determines the owner of every process on the system, via calls to [EnumProcesses](https://msdn.microsoft.com/en-us/library/windows/desktop/ms682629%28v=vs.85%29.aspx), [OpenProcess](https://msdn.microsoft.com/en-us/library/windows/desktop/ms684320%28v=vs.85%29.aspx), [GetTokenInformation](https://msdn.microsoft.com/en-us/library/windows/desktop/aa446671%28v=vs.85%29.aspx) and [LookupAccountSid](https://msdn.microsoft.com/en-us/library/windows/desktop/aa379166%28v=vs.85%29.aspx). The owner of the process is then compared against the 'NT AUTHORITY' string. This filters out any processes not being run as system or as a service. In the example below, all processes except for 'dwm.exe' and the multiple instances of 'conhost.exe' would be filtered.

[![hacker\_pos](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/hacker_pos-500x367.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/hacker_pos.png)

Figure 1. Example Running Processes

In the event a process is not filtered, memory is scraped via calls to [VirtualQueryEx](https://msdn.microsoft.com/en-us/library/windows/desktop/aa366907%28v=vs.85%29.aspx) and [ReadProcessMemory](https://msdn.microsoft.com/en-us/library/windows/desktop/ms680553%28v=vs.85%29.aspx). This is a very common approach that is witnessed in almost all memory scrapers.

[![code\_pos](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/code_pos-500x432.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/code_pos.png)

Once the data is read, FindPOS proceeds to look for track data. Starting with version 5.57, the author began making checks based on various data found within the track data. For example, in version 5.57 the author began ignoring any track data that did not have an expiration date between January 2014 to December 2030. This helped to ensure expired card data was not captured.

Additionally, the author paid close attention to the service codes that appeared within any discovered track data. The service code is a three-digit number that represents the type of card being swiped. In this particular instance, the author chose to only capture cards that held the following options:

**First Digit** -- 'International interexchange OK' or 'International interchange, use IC (chip) where feasible'

**Second Digit** -- 'Normal'

**Third Digit** -- 'No restrictions'

By adding these restrictions, the author was able to ignore cards that it did not consider to be appealing. Such cards included gift cards, debit cards, and test cards to name a few.

Any discovered track data is stored in memory until exfiltration occurs. This data is exfiltrated via the 'data' POST parameter.

### Keylogging

Starting in version 5.90, the author of FindPOS began adding keylogging to this family. Many magnetic card readers often will emulate a keyboard device. Knowing this, many POS malware authors incorporate this functionality into their families. In addition to collecting track data, keylogging also has the ability to potentially collect usernames, passwords, or other sensitive data on the victim machine.

In order to accomplish this, the author spawns a new thread that is responsible for keylogging. A common technique of creating a new empty window, registering itself as a [raw input device](https://msdn.microsoft.com/en-us/library/windows/desktop/ms645600%28v=vs.85%29.aspx), and making calls to the [GetRawInputData](https://msdn.microsoft.com/en-us/library/windows/desktop/ms645596%28v=vs.85%29.aspx) API is used.

[![code\_pos 2](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/code_pos-2-500x490.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/code_pos-2.png)

Any keystrokes are stored in memory until exfiltration occurs. The keystrokes are exfiltrated via the 'logs' POST parameter.

### Exfiltration

Exfiltration for FindPOS takes place via HTTP POST requests. A number of hardcoded domains are configured for each sample, often varying between FindPOS variants. HTTP POST requests are made every 120 seconds (2 minutes). In the event any data has been discovered, such as track data or keystroke data, this data is included. An example request from version 5.80 is shown below:

[![post\_pos rev](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/post_pos-rev-500x223.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/post_pos-rev.png)

As we can see, a number of POST variables are included in each request:

[![grid\_pos](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/grid_pos-500x117.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/grid_pos.png)

An example of decoding the 'uinfo' parameter can be seen below:

*\>\>\> import base64* *\>\>\> base64.b64decode("Sk9TSC1QQyBAIGpvc2gtUENcam9zaA==")* *'JOSH-PC @ josh-PC\\\\josh'*

Keystroke data and track data is obfuscated using a combination of Base64 encoding and a single-byte XOR encryption. Decoding this data can be seen below:

*\>\>\> import base64* *\>\>\> raw = ""* *\>\>\> for s in base64.b64decode("HxkaGxgfGhodGhoaGhsTGxcbHxoSGxobGhMbGBkeHxwdEhMaGxU="):* *\>\>\> raw += chr(ord(s) ^ 0x2a)* *\>\>\> print raw* *5301250070000191=15081010912345678901?*

In addition to data exfiltration, FindPOS added the ability to download/execute further malware. Upon sending an exfiltration request, should the server respond with a 0x1 or 0x4 byte, followed by a URL, this file will be downloaded and subsequently executed.

The file is downloaded to a temporary folder, with the file itself prefixed by 'BN'. This downloaded file is executed via a call to [CreateProcessA](https://msdn.microsoft.com/en-us/library/windows/desktop/ms682425%28v=vs.85%29.aspx). In the event the file cannot be properly downloaded or executed, it is deleted from disk.

### Domain/IP Address Information

A total of 37 domains were discovered while researching the FindPOS malware family. Of these domains, 13 unique IP addresses were discovered. The geographic location of these IP addresses can be seen below. Please refer to the Appendix for a full list of all domains.

[![map\_pos](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/map_pos-500x327.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/map_pos.png)

The majority of the domains discovered were configured with the following WHOIS information.

*Registrant Name: Julio Quinlan* *Registrant Organization: NA* *Registrant Street: 4516 Glory Road* *Registrant City: Nashville* *Registrant State/Province: TN* *Registrant Postal Code: 37204* *Registrant Country: us* *Registrant Phone: +01.9318135965* *Registrant Phone Ext:* *Registrant Fax: +01.9318135965* *Registrant Fax Ext:* *Registrant Email: barkmanueta@rambler.ru*

Please note that the registrant email was slightly different depending on the domain queried. While the information above appears legitimate, it was discovered to be falsified.

#### Related Samples -- Keylogging/LogMeIn Recon

During the course of our research, a number of similar samples were discovered. One such sample can be seen below.

**Version 8.3 -- LogMeIn Recon / Keylogger**

[![grid\_pos 2](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/grid_pos-2-500x218.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/grid_pos-2.png)

This particular sample is responsible for collecting LogMeIn account information, logging keystrokes and mouse-clicks, and periodically exfiltrating this data to a remote server. This sample shares a number of characteristics with the FindPOS samples previously discovered. Some of these similarities include the installation process, URI scheme, format of the HTTP POST requests, and the PDB string.

Upon execution, this malware will install itself in the same method as FindPOS. Additionally, a mutex is created using the technique previously mentioned. The malware will attempt determine if LogMeIn Ignition is installed on the victim machine by checking the following registry keys:

*HKCU\\Software\\LogMeIn Ignition\\\[Variable Hash\]\\Account : Email*

Any discovered emails are exfiltrated using the same HTTP POST requests witnessed in FindPOS. However, instead of using the 'data' POST parameter, this particular sample uses the 'logs' parameter. This can be seen below:

[![post\_pos 2](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/post_pos-2-500x272.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/post_pos-2.png)

The malware proceeds to log keystrokes and mouse clicks. This data is exfiltrated every two minutes.

[![post\_pos 3](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/post_pos-3-500x311.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/post_pos-3.png)

While this sample certainly could have been used to scrape track data from POS terminals that have card readers that emulate keyboard devices, I suspect this sample was more likely used to gain access to more POS machines. It is most likely that this sample was dropped on a machine that was administering multiple POS machines, and the information obtained from this particular box was leveraged to gain access to said POS machines.

It's also interesting to note that the compile timestamp for this particular sample lines up to just about two weeks after the introduction of keylogging functionality (starting in version 5.90). It would appear that right around this time the malware author added a new trick to his or her repertoire.

### Conclusion

Overall, FindPOS isn't terribly sophisticated. It lacks a number of features that we've seen in previous malware families, such as a more sophisticated command and control structure, stronger encryption, and performing [luhn](https://en.wikipedia.org/wiki/Luhn_algorithm) checks on any discovered data. Additionally, the evolution of this family provides interesting clues to the notion that this malware was written from scratch. While FindPOS may share minimal similarities with previously witnessed malware families, we are strongly confident that this malware is a brand new family.

While this malware doesn't show strong sophistication, the large number of variants shows prevalence similar to families such as [Alina](https://www.trustwave.com/Resources/SpiderLabs-Blog/Alina--Following-The-Shadow-Part-1/) and [Backoff](https://www.trustwave.com/Resources/SpiderLabs-Blog/Backoff---Technical-Analysis/). It is clear that FindPOS should be considered a strong threat to Microsoft Windows POS vendors, and measures should be taken to ensure protection.

Such measures include, but are not limited to, configuring two-factor authentication for any remote access services (LogMeIn, VNC, RDP, etc.), ensuring anti-virus is installed and updated, and ensuring POS devices are not used non-approved functions, such as browsing the web or checking email.

Palo Alto Networks customers are protected by WildFire, which automatically classifies FindPOS samples as malware. Additionally, the indicators we've discovered that are related to these attacks have been added to PANDB and Anti-Malware protection systems.

### Appendix

#### Sample Information

**Version 2.0**

[![v 2 0\_pos](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-2-0_pos-500x137.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-2-0_pos.png)

**Version 2.1**

[![v 2 1\_pos](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-2-1_pos-500x146.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-2-1_pos.png)

**Version 5.57**

[![v 5 57](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-5-57-500x148.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-5-57.png)

**Version 5.80**

[![v 5 80](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-5-80-500x169.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-5-80.png)

**Version 5.90**

[![v 5 90](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-5-90-500x219.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-5-90.png)

[![v 5 90 2](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-5-90-2-500x218.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-5-90-2.png)

**Version 6.0**

[![v 6 0](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-0-500x194.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-0.png)

[![v 6 0 2](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-0-2-500x193.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-0-2.png)

**Version 6.02**

[![v 6 02](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-02-500x169.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-02.png)

**Version 6.03**

[![v 6 03](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-03-500x193.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-03.png)

**Version 6.04**

[![v 6 04](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-04-500x168.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-04.png)

[![v 6 04 2](http://blog.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-04-2-500x181.png)](https://unit42.paloaltonetworks.com/wp-content/uploads/2015/03/v-6-04-2.png)

#### YARA Rule

import "cuckoo" rule findpos { meta: description = "FindPOS is a newly discovered POS family." category = "Point of Sale" author = "Josh Grunzweig" strings: $s1 = "oprat=2\&uid=%I64u\&uinfo=%s\&win=%d.%d\&vers=%s" nocase wide ascii $pdb1 = "H:\\\\Work\\\\Current\\\\FindStr\\\\Release\\\\FindStr.pdb" nocase wide ascii $pdb2 = "H:\\\\Work\\\\FindStrX\\\\Release\\\\FindStr.pdb" nocase wide ascii $pdb3 = "H:\\\\Work\\\\Current\\\\KeyLogger\\\\Release\\\\KeyLogger.pdb" nocase wide ascii condition: any of ($s\*) or any of ($pdb\*) or ( cuckoo.sync.mutex(/WIN\_\[a-fA-F0-9\]{16}/) and cuckoo.registry.key\_access(/\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run/) and ( cuckoo.filesystem.file\_access(/C\\:\\\\WINDOWS\\\\System32\\\\\\w{8}\\.exe/) or cuckoo.filesystem.file\_access(/C\\:\\\\Documents\\ and\\ Settings\\\\\[^\\\\\]+\\\\\\w{8}\\.exe/) ) ) }

|----------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 | import "cuckoo" rule findpos { meta: description = "FindPOS is a newly discovered POS family." category = "Point of Sale" author = "Josh Grunzweig" strings: $s1 = "oprat=2\&uid=%I64u\&uinfo=%s\&win=%d.%d\&vers=%s" nocase wide ascii $pdb1 = "H:\\\\Work\\\\Current\\\\FindStr\\\\Release\\\\FindStr.pdb" nocase wide ascii $pdb2 = "H:\\\\Work\\\\FindStrX\\\\Release\\\\FindStr.pdb" nocase wide ascii $pdb3 = "H:\\\\Work\\\\Current\\\\KeyLogger\\\\Release\\\\KeyLogger.pdb" nocase wide ascii condition: any of ($s\*) or any of ($pdb\*) or ( cuckoo.sync.mutex(/WIN\_\[a-fA-F0-9\]{16}/) and cuckoo.registry.key\_access(/\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run/) and ( cuckoo.filesystem.file\_access(/C\\:\\\\WINDOWS\\\\System32\\\\\\w{8}\\.exe/) or cuckoo.filesystem.file\_access(/C\\:\\\\Documents\\ and\\ Settings\\\\\[^\\\\\]+\\\\\\w{8}\\.exe/) ) ) } |

Back to top

### Tags

* [FindPOS](https://unit42.paloaltonetworks.com/tag/findpos/ "FindPOS")
* [Microsoft](https://unit42.paloaltonetworks.com/tag/microsoft/ "Microsoft")
* [Point of Sale](https://unit42.paloaltonetworks.com/tag/point-of-sale/ "Point of Sale")
* [Windows](https://unit42.paloaltonetworks.com/tag/windows/ "Windows")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Palo Alto Networks Researcher Identifies Critical Internet Explorer Vulnerability](https://unit42.paloaltonetworks.com/palo-alto-networks-researcher-identifies-critical-internet-explorer-vulnerability/ "Palo Alto Networks Researcher Identifies Critical Internet Explorer Vulnerability")

### Related Articles

* [How We Added WebAuthn to a Browser-Based RDP Client](https://unit42.paloaltonetworks.com/webauthn-added-to-browser-based-rdp/ "article - table of contents")
* [Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools](https://unit42.paloaltonetworks.com/active-directory-certificate-services-exploitation/ "article - table of contents")
* [01flip: Multi-Platform Ransomware Written in Rust](https://unit42.paloaltonetworks.com/new-ransomware-01flip-written-in-rust/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of a magnifying glass illuminating a glowing orange circular digital circuit interface on a dark, high-tech background.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Myth-Busting_Overview_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2025/08/Insights-icon-white.svg)Insights](https://unit42.paloaltonetworks.com/category/insights/) September 16, 2026 [#### Atomic macOS (AMOS) Stealer Activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/)

* [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS")

* [Threat intelligence](https://unit42.paloaltonetworks.com/tag/threat-intelligence/ "threat intelligence")

* [Unit 42](https://unit42.paloaltonetworks.com/tag/unit-42/ "Unit 42")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/ "Atomic macOS (AMOS) Stealer Activity")  
  ![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")  
  ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/content/pan/en_US/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)