Block Hashes

[Joshan_Lakhani]

how to block hashes in firewall . 

[SutareMayur]

@Joshan_Lakhani,

Currently it is not possible to block hashes in Palo Alto Firewall.

Mayur

[Joshan_Lakhani]

Can we block file hashes in paloalto

[Joshan_Lakhani]

For reference file is pasted below .

filename	md5	sha1	sha256	ssdeep	note
CuscalApplication.exe	01d397df2a1cf1d4c8e3615b7064856c	43a7858a0564c500e7f248762353f5b1ec3f3ef8	d928b1c1096e636463afbd19f40a6b325e159196b4497895748c31535ea503dc	3072:Ub9gBv06BB7AIiTYhs5UCe0lvtvxQGsRrDhuO7GXFeD1nylc/Bx4:Ubi+6LAIJhs551xFsF5S1eUYO	Lazarus/FASTCash malware, fraudulent job application campaign

[SutareMayur]

@Joshan_Lakhani,

Unfortunately, right now there no option to block file hashes in Palo Alto. You can try by creating Custom Signature for your use case.

Mayur

[Joshan_Lakhani]

thanks for you reply

Is any document for Customer  signature to block this hash

[SutareMayur]

@Joshan_Lakhani,

Actually it is not possible to create custom Signature in PA based on file hash value. But yes there are options custom signatures based on file types patterns. Please refer below articles.

https://live.paloaltonetworks.com/t5/Custom-Signatures/Detecting-a-specific-Linux-binary-ELF-file-us...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOFCA0

Hope it helps you!

Mayur

[OtakarKlier]

Hello,

Take a look at a program that blocks on these features. Maybe block it with your AV or some other app whitelisting application such as bit9.

Regards,