11-07-2023 04:25 AM
Hello,
While doing testing around our security controls, we did intentionally try to download Mimikatz onto an isolated workstation to see if Palo Alto blocks the download, however though Palo did alert with multiple threat names starting with "HackTool/Win32.mimikatz" and did show action as 'reset-both' however the file made through onto the workstation.
Wouldn't the AV profile be blocking the file download?
11-07-2023 06:25 PM
It may depend on how you downloaded the file. The possible causes I can think of are, the file was downloaded by using http range (resume download), or the file wasn't actually fully downloaded (you may want to check the file size or the hash on the workstation).
11-07-2023 08:40 PM
The file actually did complete the full download and it was also able to execute successfully.
11-07-2023 09:24 PM
How about the other one?
Reference:
- How Does Palo Alto Networks handle HTTP range extension?
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLjPCAW
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
