It's possible to block custom file hash-256

Reply
Highlighted
L3 Networker

It's possible to block custom file hash-256

It's possible to block custom file hash-256 in Palo alto.

Please let me know how I can check the respective file hashes disposition at a wildfire, either it is in block or not.

 

Here is below the file hashes need to know for disposition.

 

  • f743c0849d69b5ea2f7eaf28831c86c1536cc27ae470f20e49223cbdba9c677c
  • e56d45628f0c2bda30ab235657704aac50a8433bdb4215c77a2e0f52f0f31a49
  • ae431797c551c20fe2f3fe1adc08a566edfabf45abbd924f0c8da06381ab6e48
  • 4f7dd00a005caf046dd7e494fea25be2264974264d567edfc89122242b7c41bc
  • 5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6
  • 36be48e4eac81ad77aeade20b28ff8b72275832e6833f5e1b692eb99f312fd13

Accepted Solutions
Highlighted
Cyber Elite

In order to reach PANW TAC, I would suggest a ticket should be opened, referencing your concerns.

The live.paloaltnetworks.com site are community based responses; a mixture of non-PANW employees and some TAC engineers.

This would not be the correct forum for TAC case creation for your issue.

 

Thank you for your understanding.

Help the community: Like helpful comments and mark solutions

View solution in original post


All Replies
Highlighted
Cyber Elite

Have you attempted to upload these files manually on the WF portal page?

This may be the fastest way to know if they are to be blocked or not.

 

I am not sure if you query is about "CAN" we block custom hashes, or confirming that you believe they are being blocked, and you are simply questioning the ability to block them... (like "hey... i didn't know they could be blocked.. wow. cool)

 

Thanks

 

Help the community: Like helpful comments and mark solutions
Highlighted
Cyber Elite

@Mohammed_Yasin,

You can check the SHA256 hash using the WildFire API and simply check the verdict. The easiest way of doing this is using pan.wfapi

 

VirusTotal will also tell you if PAN has a listing for the file hash in a prettier fashion. 

Highlighted
L3 Networker

Thanks for your comments. Much Appreciated|||

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLOlCAO

I have studied and found no way to block custom files based on hash-256 only.

As per document file can block but based on patterns of specific file types.

 

In my case, these Hash-256 only of near firms which recently attacked by these files and damaged therefore it needs to be blocked at my end as well to avoid any risk.

 

I found few of them are blocked in wildfire but not all, so how I can add all in block state while having no file sample or pattern.

Please advise the way to block all these hashes-256 without a sample or pattern.

 

Your prompt response will be highly appreciated.

Highlighted
Cyber Elite

It should be possible to use a custom vulnerability profile.

Have you looked at this KB article (and file)

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOFCA0

 

Essentially convert your hash into HEX (may already be there) and create a custom vulnerability to drop anything that matches your file hashes.

Help the community: Like helpful comments and mark solutions
Highlighted
L3 Networker

This is to bring in to your notice, few of them mentioned hashes are already listed in Talos File Repute but not in Threat Vault. This is our request to add the following hashes in Threat Vault too to avoid any risk.

Highlighted
Cyber Elite

In order to reach PANW TAC, I would suggest a ticket should be opened, referencing your concerns.

The live.paloaltnetworks.com site are community based responses; a mixture of non-PANW employees and some TAC engineers.

This would not be the correct forum for TAC case creation for your issue.

 

Thank you for your understanding.

Help the community: Like helpful comments and mark solutions

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!