topic Re: File Blocking Cant recognize .txt files in General Topics

File Blocking Cant recognize .txt files

IEPerakis — Fri, 08 Jul 2016 09:45:47 GMT

Hello to all,

I am trying to find a way for Palo Alto to recognize some how *.txt files so I can be alert when it pass my Firewall.

Any ideas how I can make this happen?

I have search on the extension list but the .txt is not included some where.

Thank you.

Re: File Blocking Cant recognize .txt files

reaper — Fri, 08 Jul 2016 09:54:14 GMT

file blocking does not contain .txt files as there is no reliable way to identify these besides relying only on the file extention which can too easily be changed. a workaround would be to create a custom threat (or custom app) that identifies when a .txt extention is included in the payload of a session

Video Tutorial: Custom Vulnerability

Re: File Blocking Cant recognize .txt files

IEPerakis — Fri, 08 Jul 2016 11:27:38 GMT

Im getting this. How can I bypass it?

I change the pattern to "[\S]+.txt" and I still having the same error.

Re: File Blocking Cant recognize .txt files

reaper — Fri, 08 Jul 2016 11:47:28 GMT

you'll need to be a bit creative (packetcaptures of the intended traffic flow where you'd want to block exe could be helpful here) as you'll need to have at least a 7bytes continuous string in a regex signature

Examples

foo.*bar.*foobarfoo (invalid) (contains 2 fixed strings less than 7 bytes devided by a wildcard)

foo.*foobarfoo (valid)

foobarfoo.*foo (valid)

foo.{3}bar.{3}foobars (invalid)

foo.{3}foobarfoo (valid)

foo.?bar.?foobarfoo (invalid)

foo.?foobarfoo (valid)

Re: File Blocking Cant recognize .txt files

IEPerakis — Fri, 08 Jul 2016 12:09:22 GMT

Yes but with 7 bytes it can be an very long list of files and names.
I need to have something like this *.txt (1.txt, test.txt, SD@#.txt and so on and so forth..)