topic Possible to block specific files by hash? in General Topics

Possible to block specific files by hash?

SDorsey — Wed, 03 Sep 2014 13:50:50 GMT

If we are given a document which shows specific files used by bad actors in our sector, is it possible to have the PAN alert/block on these files? I have the SHA256 and MD5 hashes.

Re: Possible to block specific files by hash?

hshah — Wed, 03 Sep 2014 15:20:40 GMT

Hi Mackwage,

AFAK, there is no way to do it, not even through custom signature. Because there is no option to specify file Hash.

Why do you want to block a good file.

Regards,

Hardik Shah

Re: Possible to block specific files by hash?

HULK — Wed, 03 Sep 2014 15:20:56 GMT

Hello Macwage,

I don't think it is possible to block or alert file based on the hash value. You may post a query to DevCenter for the same.

Thanks

Re: Possible to block specific files by hash?

SDorsey — Wed, 03 Sep 2014 15:23:24 GMT

Thanks! Is Data Filtering the best way to attempt to block by filename?

Re: Possible to block specific files by hash?

HULK — Wed, 03 Sep 2014 15:28:06 GMT

A similar discussion for your reference: Re: Anyone Blocked a specific file from being downloaded?

Thanks

Re: Possible to block specific files by hash?

HULK — Wed, 03 Sep 2014 15:31:04 GMT

Hello mackwage,

You may also create a custom vulnerability signatures to prevent the downloading of specific file names. Such as Bad-Filename.zip or xyz.exe.

Please follow this document:Creating Custom Threat Signatures

Hope this helps.

Thanks

Re: Possible to block specific files by hash?

hshah — Wed, 03 Sep 2014 15:31:39 GMT

Hi Mackwage,

For any special configuration, always try custom signature. Unfortunately you dont have option to block any file based on special Hash.

You can follow bellow information for custom signature.

Regards,

Hardik Shah