It's possible to block custom file hash-256

[Mohammed_Yasin]

It's possible to block custom file hash-256 in Palo alto.

Please let me know how I can check the respective file hashes disposition at a wildfire, either it is in block or not.

Here is below the file hashes need to know for disposition.

• f743c0849d69b5ea2f7eaf28831c86c1536cc27ae470f20e49223cbdba9c677c
• e56d45628f0c2bda30ab235657704aac50a8433bdb4215c77a2e0f52f0f31a49
• ae431797c551c20fe2f3fe1adc08a566edfabf45abbd924f0c8da06381ab6e48
• 4f7dd00a005caf046dd7e494fea25be2264974264d567edfc89122242b7c41bc
• 5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6
• 36be48e4eac81ad77aeade20b28ff8b72275832e6833f5e1b692eb99f312fd13

[SCantwell_IM]

Have you attempted to upload these files manually on the WF portal page?

This may be the fastest way to know if they are to be blocked or not.

I am not sure if you query is about "CAN" we block custom hashes, or confirming that you believe they are being blocked, and you are simply questioning the ability to block them... (like "hey... i didn't know they could be blocked.. wow. cool)

Thanks

[BPry]

@Mohammed_Yasin,

You can check the SHA256 hash using the WildFire API and simply check the verdict. The easiest way of doing this is using pan.wfapi

VirusTotal will also tell you if PAN has a listing for the file hash in a prettier fashion. 

[Mohammed_Yasin]

Thanks for your comments. Much Appreciated|||

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLOlCAO

I have studied and found no way to block custom files based on hash-256 only.

As per document file can block but based on patterns of specific file types.

In my case, these Hash-256 only of near firms which recently attacked by these files and damaged therefore it needs to be blocked at my end as well to avoid any risk.

I found few of them are blocked in wildfire but not all, so how I can add all in block state while having no file sample or pattern.

Please advise the way to block all these hashes-256 without a sample or pattern.

Your prompt response will be highly appreciated.

[SCantwell_IM]

It should be possible to use a custom vulnerability profile.

Have you looked at this KB article (and file)

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOFCA0

Essentially convert your hash into HEX (may already be there) and create a custom vulnerability to drop anything that matches your file hashes.

[Mohammed_Yasin]

This is to bring in to your notice, few of them mentioned hashes are already listed in Talos File Repute but not in Threat Vault. This is our request to add the following hashes in Threat Vault too to avoid any risk.

[SCantwell_IM · Accepted solution]

In order to reach PANW TAC, I would suggest a ticket should be opened, referencing your concerns.

The live.paloaltnetworks.com site are community based responses; a mixture of non-PANW employees and some TAC engineers.

This would not be the correct forum for TAC case creation for your issue.

Thank you for your understanding.