topic Re: need to block .lockbit extension in General Topics

need to block .lockbit extension

KashifSh — Mon, 25 Oct 2021 13:21:52 GMT

as per RBI guideline ,one of our customer from banking sector wants to block .lockbit file type extension,but in firewall i didn't found any such extension.

Re: need to block .lockbit extension

BPry — Mon, 25 Oct 2021 23:23:00 GMT

@KashifSh,

PAN doesn't natively recognize the .lockbit file extension. You could potentially put together a custom vulnerability signature together so you can't download those files via the file-req pattern match options.

Re: need to block .lockbit extension

KashifSh — Tue, 26 Oct 2021 06:38:20 GMT

Hello @BPry ,

Thanks for update.

Can you share some article how create custom vulnerability signature ?

Re: need to block .lockbit extension

OtakarKlier — Tue, 26 Oct 2021 17:42:52 GMT

Hello,

Here are a few links that should help.

https://docs.paloaltonetworks.com/pan-os/u-v/pan-os-device-telemetry-metrics-reference/product-usage/metric-dt-pu-89

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClSOCA0

Regards,

Re: need to block .lockbit extension

KashifSh — Wed, 27 Oct 2021 06:31:26 GMT

Thanks @OtakarKlier