topic Re: File Blocking - .exe vs .exe in Advanced Threat Prevention Discussions

File Blocking - .exe vs .exe

raji_toor — Mon, 30 Oct 2017 19:35:46 GMT

I was testing file blocking before implementation and .exe does not get entirely blocked. 2 different exe files, one from microsoft does not get blocked while another from nirsoft gets blocked. Is there a difference to what kind of exe files get blocked.

And what about other filetypes do they also behave same.

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

http://www.nirsoft.net/utils/wireless_network_view.html

Re: File Blocking - .exe vs .exe

raji_toor — Tue, 31 Oct 2017 17:32:51 GMT

anyone ??

Re: File Blocking - .exe vs .exe

Feldiasti — Wed, 01 Nov 2017 11:11:15 GMT

as per you'r inputs its seems Palt Alto Firewall is able to block files over none-secured connection and block files from this site:

http://www.nirsoft.net/utils/wireless_network_view.html

and not able to block files over encrypted traffic

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

did you using Outbound SSL Decryption (SSL Forward Proxy)?

if Yes: In case you'r using SSL Decryprion, the firewall proxies outbound SSL connections by intercepting outbound SSL requests and generating a certificate on the fly for the site the user wants to visit. The validity date on the PA-generated certificate is taken from the validity date on the real server certificate, and the decrypted data can be inspected for threats, URL filtering, file blocking, or data filtering. Decrypted traffic is never sent off the device.

Re: File Blocking - .exe vs .exe

raji_toor — Wed, 01 Nov 2017 15:08:17 GMT

I missed the fact it was ssl session with microsoft. No we don't decrypt outbound as of now.

Re: File Blocking - .exe vs .exe

Feldiasti — Wed, 01 Nov 2017 16:27:41 GMT

Yes it’s true if don’t using outbound-ssl decryption police then you will not be able to blocking file downloaded over ssl connection.