topic Hello John in Network Security

Firesight | block wireshark .exe

John — Tue, 12 Mar 2019 13:04:15 GMT

We would like to know how to block wireshark .exe in firesight.

Hello John

Jetsy Mathew — Tue, 12 Jul 2016 05:34:43 GMT

Hello John

If you have malware license using file policy under policies 》 access control 》 File Policy , you can block the .exe extension.Do you want block only for wireshark.exe or all other .exe extension files ?

Rate if post helps you

Regards

Jetsy

Hello Jetsy,

John — Tue, 12 Jul 2016 06:55:18 GMT

Hello Jetsy,

We want to block all installer of sniffing tool, like wireshark.exe.

Hello John,

Pujita Patni — Tue, 12 Jul 2016 16:39:02 GMT

Hello John,

When the ASA FirePOWER module / Firepower devices detects an eligible file, the ASA FirePOWER module / Firepower devices then performs amalware cloud lookupusing the file’s SHA-256 hash value. Based on these results, the Cisco cloud returns a file disposition to the ASA FirePOWER module.

If a file has a disposition in the cloud that you know to be incorrect, you can add the file’s SHA-256 value to a file list:

To treat a file as if the cloud assigned a clean disposition, add the file to the clean list.
To treat a file as if the cloud assigned a malware disposition, add the file to the custom detection list.

If the system detects a file’s SHA-256 value on a file list, it takes the appropriate action without performing a malware lookup or checking the file disposition.

In order to block wireshark and other similar tools, please browse to

FMC >> Objects >> Objects Management >> File List >> Custom Detection List >> "Edit using the pencil icon" >> "Choose Calculate SHA in drop-down" >> Browse and Select file types for this list (For example, Wireshark EXEs, DMGs, etc)

Hope this helps.

Regards,

Pujita

Rate if this helps.

You may need to list all

Ed Padilla Jr — Fri, 15 Jul 2016 19:21:06 GMT

You may need to list all types of sniffing tools files and create their malware detection signature, including wireshark, nmap, and other types and add them to the malware detection policy. Cisco TAC can assist or you can load your own. Happy tunning.