topic Re: Block md5 hashes in Cortex XDR Discussions

Block md5 hashes

Marsooq-Akkaradathil — Thu, 25 Jun 2020 09:17:04 GMT

Dear team,

is it possible to block IOC based md5 hashes in cortex xdr?

Re: Block md5 hashes

dfalcon — Wed, 15 Jul 2020 14:29:17 GMT

Yes. Go to Response > Action Center > Blacklist > New Action. From there either enter the MD5 entry or import a list of them.

Re: Block md5 hashes

KRisselada — Fri, 05 Mar 2021 03:47:10 GMT

Hi @dfalcon Still looking for this but I wanted to ask here also. Is it then possible to change the Alert Severity of the Alert Name = "Administrative Hash Exception" from LOW (which it appears to default to now) to Medium, so that an INCIDENT is created. Right now it will BLOCK but no Incident is created, as its LOW Severity alert.

Re: Block md5 hashes

dfalcon — Tue, 09 Mar 2021 21:44:39 GMT

Hi @KRisselada-

From the alert, what is listed as the source?

Re: Block md5 hashes

KRisselada — Tue, 09 Mar 2021 21:51:46 GMT

@dfalcon its Alert Source = XDR Agent, Alert Name = Administrative Hash Exception

Its set as Low, with regard to Severity, I wondered if I could adjust the Sev from the default Low, to say Medium. I wondered if Scoring Rules (within Incident Management) might do that, but does not seem to be, or I am not doing it correctly.

Re: Block md5 hashes

QDSupportUser — Thu, 11 Mar 2021 08:46:23 GMT

actually SHA256 only. there is no provision for providing and MD5 hash that we can see. And even if we try to add an MD5, the system doesn't accept any MD5 hashes

Re: Block md5 hashes

KRisselada — Fri, 12 Mar 2021 00:51:41 GMT

Thanks @QDSupportUser actually I didn't come up with the subject line that indicated MD5. But the goal (via SHA256) was close. Essentially was looking to have an Incident created from an alert named Administrative Hash Exception, which seems to be by default set to LOW. I was looking to make that an Incident.

So to restate here was looking to:

add Hash to Block list, have Alert generated (done, this works👍)
Have that alert create an Incident (does not do that now 👎, I believe because the Severity of the alert is set to Low)
- I also don't wish to have EVERY Low Sev alert become an Incident, just the "Administrative Hash Exception" alerts

Hope that helps.