topic Re: File Types and Md5 Hashes in General Topics

File Types and Md5 Hashes

scottlsattler — Tue, 02 Jul 2013 16:10:24 GMT

I write SIEM content (Mostly Arcsight and Q1), I have found PAN to be very effective in identifying adverse traffic. One thing that would be great, that in addition to recognizing the file type such as "file Microsoft PE File(52060)" which is useful as a poor mans DLP, with which I can track whats coming and going, it's only so effective by just having the file name. It would be much more effective if the md5 hash value of the file was written to the log file. Then I can correlate the log file md5 hash with my known bad hash database....Can this be done, is it there and I have missed it?

Thanks

Re: File Types and Md5 Hashes

Chatri — Tue, 02 Jul 2013 16:35:54 GMT

Unfortunately No.

The Palo Alto will not buffer through the entire file in order to get the hash of the file.

But if you are using Wildfire to forward certain file types to the wildfire portal, it will give you the SHA for the file but not MD5.

I hope this is helpful.

Re: File Types and Md5 Hashes

mikand — Thu, 04 Jul 2013 18:29:48 GMT

Wouldnt it still be possible to create a md5 of a stream since md5 works with 512bit blocks?

Cryptographic hash function - Wikipedia, the free encyclopedia

MD5 - Wikipedia, the free encyclopedia

Re: File Types and Md5 Hashes

VinceM — Mon, 08 Jul 2013 07:32:55 GMT

Hi,

Problem will be to capture all the file's stream. With the palo, you're only be able to capture stream if threat is indentify in it and only on a the "infected" part of stream.

the SHA256 hash is calculate when creating a forwarding profile for wildfire. May be possible to retrieve it through the API ?