topic Re: How to Enable WildFire to block jar file with 'malicious' Verdict in General Topics

How to Enable WildFire to block jar file with 'malicious' Verdict

Steve-Phillips — Wed, 31 Jan 2018 09:34:03 GMT

Hello Everyone,

New to Palo Alto firewalls and new to this forum.

Can I please ask how I go about changing the Wildfire action on a jar file to block? The action for this file has been to allow the file, despite the file being flagged as "malicious, as can be seen below:

I wish to change the action to "block", as is the case with the "pe" files I can see in the Wildfire logs, as can be seen here:

Many thanks in advance.

Regards,

Steve

Re: How to Enable WildFire to block jar file with 'malicious' Verdict

BPry — Wed, 31 Jan 2018 16:14:45 GMT

@Steve-Phillips,

Within the Antivirus Security Profile that is assigned to the rule allowing the SMTP traffic to pass, you'll have to modify the 'WildFire Action' to reset-both instead of the default action of 'alert'. This article HERE should point you in the proper direction

Re: How to Enable WildFire to block jar file with 'malicious' Verdict

Steve-Phillips — Thu, 01 Feb 2018 17:08:17 GMT

Dear BPry, many thanks for your reply.

I have checked the Anti-Virus profile that is assigned to the applicable rule (Internet to Email Gateway) and the WildFire action is set to "reset-both" for all the listed decoders, including smtp, as can be seen here:

It would therefore seem that some other setting is at play here that is not immediately obvious.

I have examined the WildFire Analysis security profile, but this is set to analyze any file type and any application, so there does not appear to be a applicable setting here:

I'll continue to investigate..

Regards,

Steve

Re: How to Enable WildFire to block jar file with 'malicious' Verdict

BPry — Fri, 02 Feb 2018 13:58:46 GMT

@Steve-Phillips,

So one thing to potentially think about is if wildfire actually 'knew' about the file yet. A file that hasn't been inspected by WildFire which doesn't have identifyable markers for the Antivirus engine may log an as an 'alert' action until a wildfire signature has been generated for it. That may explain why you are seeing 'alert' actions rather than the desired 'reset-both' with this traffic.

Re: How to Enable WildFire to block jar file with 'malicious' Verdict

Steve-Phillips — Thu, 08 Feb 2018 09:37:04 GMT

Dear BPry,

Many thanks for your reply and theory for why the email was allowed despite being malicious.

I have captured the timestamps of the Wildfire evets here, in case that helps accurately diagnose the issue:

WildFire Analysis Summary

File Information

File Type JAVA JAR

File Signer

SHA-256 149862f4894c9dba2b21b507fa7bde835e6a6a44e35040331c5ab1de3ec4027d

SHA1 b8aed21b09bda3f02c54c53267ba696a1286e092

MD5 0ecacad6f88e1ddb859e881c1662b4a9

File Size 556535 bytes

First Seen Timestamp 2018-01-26 06:28:06 UTC

Verdict malware

Does this information give more visibility to the issue?

Many thanks,

Steve