Possible to block specific files by hash?

[SDorsey]

If we are given a document which shows specific files used by bad actors in our sector, is it possible to have the PAN alert/block on these files? I have the SHA256 and MD5 hashes.

[hshah]

Hi Mackwage,

AFAK, there is no way to do it, not even through custom signature. Because there is no option to specify file Hash.

Why do you want to block a good file.

Regards,

Hardik Shah

[HULK]

Hello Macwage,

I don't think it is possible to block or alert file based on the hash value. You may post a query to DevCenter for the same.

Thanks

[SDorsey]

Thanks! Is Data Filtering the best way to attempt to block by filename?

[HULK]

A similar discussion for your reference: Re: Anyone Blocked a specific file from being downloaded?

Thanks

[HULK · Accepted solution]

Hello mackwage,

You may also create a custom vulnerability signatures to prevent the downloading of specific file names. Such as Bad-Filename.zip or xyz.exe.

Please follow this document:Creating Custom Threat Signatures

Hope this helps.

Thanks

[hshah]

Hi Mackwage,

For any special configuration, always try custom signature. Unfortunately you dont have option to block any file based on special Hash.

You can follow bellow information for custom signature.

Regards,

Hardik Shah