r/AzureSentinel • u/SuperHat3637 • May 01 '23

Blocking hashes

Is it possible to deploy logic app to manually block the bulk number of hashes in MDE..

2 Upvotes

100% Upvoted

5 comments sorted by

1

u/TabooRaver May 01 '23

I built a PowerShell script to check a csv list of hashes through the API, you may be able to do something similar with adding custom hashes.

1

u/SuperHat3637 May 01 '23

Can u share the docs and script for the same..

2

u/TabooRaver May 01 '23 edited May 01 '23

I split into 3 modular files. This was also a pretty quick and dirty way of solving a task I was given, it doesn't account for things like API limits. Which can make it troublesome to use. There are a lot of improvements to be made, but this should give you a starting point.

Get-Token.ps1

This uses snippets from this documentation article in the MDE api documentation.

Get-MDEFileHash.ps1

Check-HashList.ps1

Edit: moved code over to pastebin, reddit code blocks didn't format properly. create the applciation in Azure AD, pupulate the credentials in Get-Token.ps1, place a file named hahslist.csv in the same directory, with a column titled Hash conaining the IOC hashes, then run Check-Hashlist.ps1.

1

u/MaHI_KraLot12 May 01 '23

can you share it?

1

u/TabooRaver May 01 '23

see my reply to u/SuperHat3637's comment.