Custom App to allow Office 07/10 (docx/xlsx/etc) while blocking zip

[CarloGrossman]

Our current file blocking policy blocks zip files, however, users are getting blocked from downloading compressed Office documents.  Office 2007 and 2010 save files in the docx, pptx, xlsx type extensions.  They are technically zip files, since you can change the extension to .zip and it will open in a zip program.

The thought was to create a custom signature to allow these files, since the following seems to be persistent.

The file starts with: 50 4B 03 04 14 00 06 00 08 00 00 00 21 00

At offset 1E, it contains: 5B 43 6F 6E 74 65 6E 74 5F 54 79 70 65 73 5D 2E 78 6D 6C  (this is the description for the file name [Content_Types].xml, which appears in these types of files)

Is there a way to make this work?

Thanks,

Carlo

[mikand · Accepted solution]

I guess so, take a look at rkim's first reply in https://live.paloaltonetworks.com/thread/2898?tstart=0 for guidelines on how to submit app requests.

[CarloGrossman]

How do I create a custom application or data filtering profile for this?

[CarloGrossman]

If I could do a pattern match in the context of file-ZIP-body, that would help, but that doesn't seem to exist.

[SOC_CSG]

We have the same problem. I'm looking for ...

Do you know any solution?

:smileyconfused:

Regards,

[Hithead]

hi,

feature request already open: FR ID:1829

please contact your SE to vote for it! I already did and we need more votes