topic Re: File types need to block in General Topics

File types need to block

SurajN — Wed, 08 Dec 2021 17:06:37 GMT

The file type is malicious as per the swift advisory 2021, that need to be block on the Palo alto Firewall.

File Type .gmu,.ekt, .jpn,.er,

Re: File types need to block

SurajN — Wed, 08 Dec 2021 17:07:42 GMT

Any solution is available on this .how to block on firewall.

Re: File types need to block

OtakarKlier — Wed, 08 Dec 2021 17:17:15 GMT

Hello,

The PAN only know of certain filetypes. That said here are a few things to think about:

Only allow the file types the PAN knows? Its a whitelist approach rather than a blacklist approach.
Enable all AV and Threat options including wildfire. This should block any known bad files and potentially new ones with wildfire. Also use secure DNS and URL filtering to prevent dropper loads.

Sorry its not a direct answer. Perhaps others may have other insights.

Regards,

Re: File types need to block

BPry — Thu, 09 Dec 2021 21:45:37 GMT

@SurajN,

The firewall isn't the answer to all problems; it's relatively seamless to block the execution of file types on macOS, Linux, and Windows on managed endpoints. That's really the "answer" here instead of attempting to do it at the network level. Because the firewall file-blocking is type based and needs specific decoders, the capabilities there are limited.

You could potentially try looking at custom threat signatures to see if they could potentially be used to rig something up, but last I looked this wasn't really a clear cut solution and wasn't accurately blocking files completely.