Block a digital signer?

[enewman]

Does anyone know if there is a way to block a digital signer? Or does anyone have any better ideas for blocking Wave Browser without blocking all of their ever-changing thousands of hashes?

[eluis]

Hi Enewman,

typically the signer block list is maintained by PANW team and it is distributed via content updates. 

The way to block a process by the customers is to block the hash as you have done. The hash will be checked before the WF verdict so it will prevail before WF check. 
An indirect way to create a signer block is the following: 

You create a custom BIOC for this signer and then you push it on to a restriction profile.  

This way the process will execute but inmediately the behavioural threat protection will kick in and block & kill the process

I hope this helps, like it please if it was useful

Have Fun with it, 

Luis 

[PeteJacobCF]

its funny your brining this up, I have seen tons of activity on this as well this week. I ended up blocking the hash but I am sure that will change at some point. 

[eumbach]

Same, just added a new BIOC to take care of it. 

[KRisselada]

Hello @eumbach would you possibly share what your BIOC looked like.  Looking for tips, not had much experience in creating.

[mrowland]

You can also request a custom exception json from support that will add signers to the Digital Signer Restriction list

[eumbach]

Hey Sorry I had missed this.