Data pattern for SSN or CC with file type as text/html is matching .dll files

[rsingh]

Hi All,

In my LAB Test,

Here is what I did,

++ Created a data pattern with CC (10) and SSN (10) to match SSN or CC

++ Under Data Filtering Profile, added the pattern with file type as "text/html" with Alert threshold as 1

++ Sent an email with a file "TESTssn.dll"

++ It is hitting the rule

++ It seems Firewall is detecting the DLL files under file type "text/html"

Note:

How I created the file,

a) Created a text file with some random SSN number in it

b) Changed the extension from .txt to .dll

Is this expected? or its False positive?

Whenever we try to open a .dll file, windows by default select HTML or we can open it as a text file. I am not sure if this information is related.

Any thoughts?