topic Re: Pass word protected Winrar file in General Topics

Re: Pass word protected Winrar file

Sanssj — Wed, 13 Mar 2019 20:56:55 GMT

Can anyone throw some light on Best Practise for inspecting Password Protected Winrar/zip files on Palo's.

Thanks

OtakarKlier — Wed, 13 Mar 2019 21:18:07 GMT

Hello,

The PAN will do its best to inspect it, but if it cant decrypt it it can only scan its hash to see if has been reported before.

Hope that helps.

Raido_Rattameister — Thu, 14 Mar 2019 13:21:50 GMT

Palo firewall will not look into rar at all. It is simply passed through it (if permitted by file blocking policy).

Palo is using stream based AV. To inspect rar it would need to be downloaded fully first.

rar is inspected only if it is uploaded to wildfire. But if rar is password protected then it can't be inspected at all.