Malicious .zip file detected as "HackTool/Win32.mimikatz" by AV policy and action shows as 'reset-both' but the file was not blocked

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Malicious .zip file detected as "HackTool/Win32.mimikatz" by AV policy and action shows as 'reset-both' but the file was not blocked

L0 Member

Hello,

 

While doing testing around our security controls, we did intentionally try to download Mimikatz onto an isolated workstation to see if Palo Alto blocks the download, however though Palo did alert with multiple threat names starting with "HackTool/Win32.mimikatz" and did show action as 'reset-both' however the file made through onto the workstation.

 

Wouldn't the AV profile be blocking the file download?

 

 

3 REPLIES 3

L5 Sessionator

It may depend on how you downloaded the file. The possible causes I can think of are, the file was downloaded by using http range (resume download), or the file wasn't actually fully downloaded (you may want to check the file size or the hash on the workstation).

The file actually did complete the full download and it was also able to execute successfully.

How about the other one?

 

Reference:
- How Does Palo Alto Networks handle HTTP range extension?
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PLjPCAW

 

  • 6341 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!