topic Wildfire on Password protected zip & RAR in General Topics

Wildfire on Password protected zip & RAR

SeanDeHarris — Mon, 20 Feb 2023 09:19:59 GMT

Hello experts,

How would the Wildfire (submission) on firewall deal with these types 1) password protected zip 2) password protected 7-zip 3) password protected RAR?

would it automatically submit by Firewall or need manual submit thru Wildfire portal or API?

any ideas?

Thanks

Harris.

Re: Wildfire on Password protected zip & RAR

BPry — Mon, 20 Feb 2023 22:34:28 GMT

@SeanDeHarris,

Since it's encrypted you would need to do the submission manually after decrypting the archive or otherwise automate that process through the WildFire API as long as you're able to programmatically grab the file and the password.

Re: Wildfire on Password protected zip & RAR

kiwi — Tue, 21 Feb 2023 13:29:06 GMT

Hi @SeanDeHarris ,

As @BPry mentioned this is going to be a manual or scripted process as archive files that are multi-part or password protected cannot be analyzed. (source: https://docs.paloaltonetworks.com/wildfire/u-v/wildfire-whats-new/latest-wildfire-cloud-features/archive-and-elf-file-analysis)

Kind regards,

-Kiwi.