Malware Hash

Use the Malware Hash page to define a list of malware files and their hash functions. When FortiSIEM monitors a directory, it generates these directory events:

Directory Event	Generated by This Action
PH_DEV_MON_CUST_FILE_CREATE	New file creation
PH_DEV_MON_CUST_FILE_SCAN	Directory is scanned
PH_DEV_MON_CUST_FILE_CHANGE_CONTENT	Changes in file content

When FortiSIEM scans a file and collects its hash, it uses the system rule Malware Hash Check to check the list of malware hashes. FortiSIEM will then trigger an alert if a match is found. A Python Threat Feed Framework is also available, see here.

The following sections describe Malware Hashes:

• Adding a Malware Hash

• Modifying a Malware Hash

• Importing/Updating User-defined Malware Hash

• Viewing Malware Hash