topic Re: Malicious file not getting blocked in General Topics

Malicious file not getting blocked

Farzana — Mon, 28 Aug 2017 09:56:27 GMT

Hello,

An email attachment has been classified by Wildfire as malicious. However, it was not blocked and just an alert was logged.

Below are two screenshots from the Wildfire submission and threat logs.

Any idea why has the Vulnerability Protection classified this threat as medium even though WildFire classified this file as malicious? How to make sure it is blocked?

Thanks in advance.

Re: Malicious file not getting blocked

kiwi — Mon, 28 Aug 2017 10:18:31 GMT

Hi @Farzana,

I'm guessing you don't have your device configured to drop this.

The default WildFire action for the SMTP decoder is alert :

default action for smtp decoder is alert

Also, this article might be useful :

How-to-Enable-WildFire-to-Block-File-with-malicious-Verdict

Hope this helps !

-Kiwi.

Re: Malicious file not getting blocked

BPry — Mon, 28 Aug 2017 14:04:55 GMT

@Farzana,

Something to keep in mind as well is that most documents that I see from SMTP has to be sent to wildfire and the verdict has to come after it's been analyzed; so dropping it on the fly doesn't really work that well and might not be advisable depending on your companies tolerance to any false positive emails being unrecoverable.