topic Re: Malicious .zip file detected as "HackTool/Win32.mimikatz" by AV policy and action shows as 'reset-both' but the file was not blocked in Advanced Threat Prevention Discussions

Malicious .zip file detected as "HackTool/Win32.mimikatz" by AV policy and action shows as 'reset-both' but the file was not blocked

kaustubh-Mhatre — Tue, 07 Nov 2023 12:25:16 GMT

Hello,

While doing testing around our security controls, we did intentionally try to download Mimikatz onto an isolated workstation to see if Palo Alto blocks the download, however though Palo did alert with multiple threat names starting with "HackTool/Win32.mimikatz" and did show action as 'reset-both' however the file made through onto the workstation.

Wouldn't the AV profile be blocking the file download?

Re: Malicious .zip file detected as "HackTool/Win32.mimikatz" by AV policy and action shows as 'reset-both' but the file was not blocked

ymiyashita — Wed, 08 Nov 2023 02:25:24 GMT

It may depend on how you downloaded the file. The possible causes I can think of are, the file was downloaded by using http range (resume download), or the file wasn't actually fully downloaded (you may want to check the file size or the hash on the workstation).

Re: Malicious .zip file detected as "HackTool/Win32.mimikatz" by AV policy and action shows as 'reset-both' but the file was not blocked

kaustubh-Mhatre — Wed, 08 Nov 2023 04:40:19 GMT

The file actually did complete the full download and it was also able to execute successfully.

Re: Malicious .zip file detected as "HackTool/Win32.mimikatz" by AV policy and action shows as 'reset-both' but the file was not blocked

ymiyashita — Wed, 08 Nov 2023 05:24:11 GMT

How about the other one?

Reference:
- How Does Palo Alto Networks handle HTTP range extension?
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLjPCAW