It's possible to block custom file hash-256

cancel
Showing results for 
Search instead for 
Did you mean: 

It's possible to block custom file hash-256

L4 Transporter

It's possible to block custom file hash-256 in Palo alto.

Please let me know how I can check the respective file hashes disposition at a wildfire, either it is in block or not.

 

Here is below the file hashes need to know for disposition.

 

  • f743c0849d69b5ea2f7eaf28831c86c1536cc27ae470f20e49223cbdba9c677c
  • e56d45628f0c2bda30ab235657704aac50a8433bdb4215c77a2e0f52f0f31a49
  • ae431797c551c20fe2f3fe1adc08a566edfabf45abbd924f0c8da06381ab6e48
  • 4f7dd00a005caf046dd7e494fea25be2264974264d567edfc89122242b7c41bc
  • 5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6
  • 36be48e4eac81ad77aeade20b28ff8b72275832e6833f5e1b692eb99f312fd13
1 ACCEPTED SOLUTION

Accepted Solutions

In order to reach PANW TAC, I would suggest a ticket should be opened, referencing your concerns.

The live.paloaltnetworks.com site are community based responses; a mixture of non-PANW employees and some TAC engineers.

This would not be the correct forum for TAC case creation for your issue.

 

Thank you for your understanding.

Help the community: Like helpful comments and mark solutions

View solution in original post

6 REPLIES 6

Cyber Elite
Cyber Elite

Have you attempted to upload these files manually on the WF portal page?

This may be the fastest way to know if they are to be blocked or not.

 

I am not sure if you query is about "CAN" we block custom hashes, or confirming that you believe they are being blocked, and you are simply questioning the ability to block them... (like "hey... i didn't know they could be blocked.. wow. cool)

 

Thanks

 

Help the community: Like helpful comments and mark solutions

Cyber Elite
Cyber Elite

@Mohammed_Yasin,

You can check the SHA256 hash using the WildFire API and simply check the verdict. The easiest way of doing this is using pan.wfapi

 

VirusTotal will also tell you if PAN has a listing for the file hash in a prettier fashion. 

Thanks for your comments. Much Appreciated|||

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLOlCAO

I have studied and found no way to block custom files based on hash-256 only.

As per document file can block but based on patterns of specific file types.

 

In my case, these Hash-256 only of near firms which recently attacked by these files and damaged therefore it needs to be blocked at my end as well to avoid any risk.

 

I found few of them are blocked in wildfire but not all, so how I can add all in block state while having no file sample or pattern.

Please advise the way to block all these hashes-256 without a sample or pattern.

 

Your prompt response will be highly appreciated.

It should be possible to use a custom vulnerability profile.

Have you looked at this KB article (and file)

 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClOFCA0

 

Essentially convert your hash into HEX (may already be there) and create a custom vulnerability to drop anything that matches your file hashes.

Help the community: Like helpful comments and mark solutions

This is to bring in to your notice, few of them mentioned hashes are already listed in Talos File Repute but not in Threat Vault. This is our request to add the following hashes in Threat Vault too to avoid any risk.

In order to reach PANW TAC, I would suggest a ticket should be opened, referencing your concerns.

The live.paloaltnetworks.com site are community based responses; a mixture of non-PANW employees and some TAC engineers.

This would not be the correct forum for TAC case creation for your issue.

 

Thank you for your understanding.

Help the community: Like helpful comments and mark solutions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!