topic Re: How to block .vbox files for protect ransomware? in Advanced Threat Prevention Discussions

How to block .vbox files for protect ransomware?

Noviceadmin — Sat, 19 Sep 2020 16:37:16 GMT

The ransomware is update again.

Now include virus in windows 7 virtual machine and attack host via share folder to host.

Palo alto NGFW not have .vbox file type (have vmdk only).

How to custom .vbox file type blocking or please update .vbox file type for blocking.

Ref : https://www.bleepingcomputer.com/news/security/maze-ransomware-now-encrypts-via-virtual-machines-to-evade-detection/?fbclid=IwAR1hw3elJtSyll67WRRVd7rypnCOtONyJiDgPyz1zU62jcjD1hkY_PFWgqE

Re: How to block .vbox files for protect ransomware?

mivaldi — Mon, 21 Sep 2020 23:11:19 GMT

Place a Feature Request with your Palo Alto Networks SE.

Re: How to block .vbox files for protect ransomware?

Hatch_J — Mon, 12 Oct 2020 10:20:28 GMT

nice

Re: How to block .vbox files for protect ransomware?

Aaron765 — Thu, 15 Jul 2021 04:33:25 GMT

Run it, yes, of course. Give the sudo password, no. The sudo password is needed in order to modify system files or settings. However, ransomware encrypts the user's personal files, which are fully accessible by the user without a password. The sudo password would be needed to encrypt files of other users, however.

myloweslife