topic Re: It's possible to block custom file hash-256 in General Topics

It's possible to block custom file hash-256

Mohammed_Yasin — Mon, 14 Sep 2020 13:57:25 GMT

It's possible to block custom file hash-256 in Palo alto.

Please let me know how I can check the respective file hashes disposition at a wildfire, either it is in block or not.

Here is below the file hashes need to know for disposition.

f743c0849d69b5ea2f7eaf28831c86c1536cc27ae470f20e49223cbdba9c677c
e56d45628f0c2bda30ab235657704aac50a8433bdb4215c77a2e0f52f0f31a49
ae431797c551c20fe2f3fe1adc08a566edfabf45abbd924f0c8da06381ab6e48
4f7dd00a005caf046dd7e494fea25be2264974264d567edfc89122242b7c41bc
5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6
36be48e4eac81ad77aeade20b28ff8b72275832e6833f5e1b692eb99f312fd13

Re: It's possible to block custom file hash-256

S.Cantwell — Mon, 14 Sep 2020 16:32:05 GMT

Have you attempted to upload these files manually on the WF portal page?

This may be the fastest way to know if they are to be blocked or not.

I am not sure if you query is about "CAN" we block custom hashes, or confirming that you believe they are being blocked, and you are simply questioning the ability to block them... (like "hey... i didn't know they could be blocked.. wow. cool)

Thanks

Re: It's possible to block custom file hash-256

BPry — Mon, 14 Sep 2020 17:15:57 GMT

@Mohammed_Yasin,

You can check the SHA256 hash using the WildFire API and simply check the verdict. The easiest way of doing this is using pan.wfapi

VirusTotal will also tell you if PAN has a listing for the file hash in a prettier fashion.

Re: It's possible to block custom file hash-256

Mohammed_Yasin — Tue, 15 Sep 2020 05:30:28 GMT

Thanks for your comments. Much Appreciated|||

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLOlCAO

I have studied and found no way to block custom files based on hash-256 only.

As per document file can block but based on patterns of specific file types.

In my case, these Hash-256 only of near firms which recently attacked by these files and damaged therefore it needs to be blocked at my end as well to avoid any risk.

I found few of them are blocked in wildfire but not all, so how I can add all in block state while having no file sample or pattern.

Please advise the way to block all these hashes-256 without a sample or pattern.

Your prompt response will be highly appreciated.

Re: It's possible to block custom file hash-256

S.Cantwell — Tue, 15 Sep 2020 13:22:50 GMT

It should be possible to use a custom vulnerability profile.

Have you looked at this KB article (and file)

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOFCA0

Essentially convert your hash into HEX (may already be there) and create a custom vulnerability to drop anything that matches your file hashes.

Re: It's possible to block custom file hash-256

Mohammed_Yasin — Tue, 15 Sep 2020 13:24:01 GMT

This is to bring in to your notice, few of them mentioned hashes are already listed in Talos File Repute but not in Threat Vault. This is our request to add the following hashes in Threat Vault too to avoid any risk.

Re: It's possible to block custom file hash-256

S.Cantwell — Tue, 15 Sep 2020 13:50:46 GMT

In order to reach PANW TAC, I would suggest a ticket should be opened, referencing your concerns.

The live.paloaltnetworks.com site are community based responses; a mixture of non-PANW employees and some TAC engineers.

This would not be the correct forum for TAC case creation for your issue.

Thank you for your understanding.