topic Re: Block a digital signer? in Cortex XDR Discussions

Block a digital signer?

enewman — Wed, 10 Nov 2021 17:11:01 GMT

Does anyone know if there is a way to block a digital signer? Or does anyone have any better ideas for blocking Wave Browser without blocking all of their ever-changing thousands of hashes?

Re: Block a digital signer?

eluis — Thu, 11 Nov 2021 14:30:38 GMT

Hi Enewman,

typically the signer block list is maintained by PANW team and it is distributed via content updates.

The way to block a process by the customers is to block the hash as you have done. The hash will be checked before the WF verdict so it will prevail before WF check.
An indirect way to create a signer block is the following:

You create a custom BIOC for this signer and then you push it on to a restriction profile.

This way the process will execute but inmediately the behavioural threat protection will kick in and block & kill the process

I hope this helps, like it please if it was useful

Have Fun with it,

Luis

Re: Block a digital signer?

P.Jacob — Thu, 11 Nov 2021 15:36:01 GMT

its funny your brining this up, I have seen tons of activity on this as well this week. I ended up blocking the hash but I am sure that will change at some point.

Re: Block a digital signer?

eumbach — Sat, 13 Nov 2021 02:41:40 GMT

Same, just added a new BIOC to take care of it.

Re: Block a digital signer?

KRisselada — Tue, 23 Nov 2021 18:17:49 GMT

Hello @eumbach would you possibly share what your BIOC looked like. Looking for tips, not had much experience in creating.

Re: Block a digital signer?

mrowland — Tue, 13 Dec 2022 00:57:04 GMT

You can also request a custom exception json from support that will add signers to the Digital Signer Restriction list

Re: Block a digital signer?

eumbach — Tue, 13 Dec 2022 19:16:54 GMT

Hey Sorry I had missed this.