topic Re: Block Hashes in General Topics

Block Hashes

Joshan_Lakhani — Sun, 29 Mar 2020 05:33:18 GMT

how to block hashes in firewall .

Re: Block Hashes

SutareMayur — Sun, 29 Mar 2020 06:58:49 GMT

@Joshan_Lakhani,

Currently it is not possible to block hashes in Palo Alto Firewall.

Mayur

Re: Block Hashes

Joshan_Lakhani — Sun, 29 Mar 2020 10:54:20 GMT

Can we block file hashes in paloalto

Re: Block Hashes

Joshan_Lakhani — Sun, 29 Mar 2020 11:27:59 GMT

For reference file is pasted below .

filename	md5	sha1	sha256	ssdeep	note
CuscalApplication.exe	01d397df2a1cf1d4c8e3615b7064856c	43a7858a0564c500e7f248762353f5b1ec3f3ef8	d928b1c1096e636463afbd19f40a6b325e159196b4497895748c31535ea503dc	3072:Ub9gBv06BB7AIiTYhs5UCe0lvtvxQGsRrDhuO7GXFeD1nylc/Bx4:Ubi+6LAIJhs551xFsF5S1eUYO	Lazarus/FASTCash malware, fraudulent job application campaign

Re: Block Hashes

SutareMayur — Sun, 29 Mar 2020 12:21:03 GMT

@Joshan_Lakhani,

Unfortunately, right now there no option to block file hashes in Palo Alto. You can try by creating Custom Signature for your use case.

Mayur

Re: Block Hashes

Joshan_Lakhani — Sun, 29 Mar 2020 12:23:27 GMT

thanks for you reply

Is any document for Customer signature to block this hash

Re: Block Hashes

SutareMayur — Sun, 29 Mar 2020 13:15:36 GMT

@Joshan_Lakhani,

Actually it is not possible to create custom Signature in PA based on file hash value. But yes there are options custom signatures based on file types patterns. Please refer below articles.

https://live.paloaltonetworks.com/t5/Custom-Signatures/Detecting-a-specific-Linux-binary-ELF-file-using-a-custom/m-p/88888#M105

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOFCA0

Hope it helps you!

Mayur

Re: Block Hashes

OtakarKlier — Mon, 30 Mar 2020 17:07:06 GMT

Hello,

Take a look at a program that blocks on these features. Maybe block it with your AV or some other app whitelisting application such as bit9.

Regards,