Real-Time Inline Prevention with EP Advanced File Handling

[prneelakrish]

Author: Pranesh Neelakrishnan (@prneelakrish)  , Principal Product Manager (Prisma Access)

In today’s threat landscape, the "Patient Zero" problem–where a never-before-seen malicious file reaches an endpoint before a signature can be created–remains one of the most significant gaps in enterprise security. Traditional signature-based defenses often require hours or even days to update, leaving a critical window of vulnerability.

To solve this, Palo Alto Networks is introducing EP Advanced File Handling . This solution integrates Prisma Access Explicit Proxy (EP) with WildFire to provide real-time, inline malware detection and prevention for your web traffic.

 

Why EP Advanced File Handling?

Traditional firewall-based inspection has served us well, but as threats evolve, so must our architecture. EP Advanced File Handling delivers several critical advantages over legacy methods:

EP Advanced File Handling significantly enhances security by leveraging real-time static analysis, enabling instantaneous inline protection that closes the critical security gap often left by traditional methods. Unlike legacy firewall-based inspection, this solution supports over 60 different file types–including PDFs, Office documents, and scripts–with support for file sizes up to 100 MBs. By shifting to this cloud-native, real-time approach, organizations benefit from a drastic reduction in false positives and the ability to detect and block sophisticated threats in seconds, effectively neutralizing risks before they can compromise an endpoint.

 

Validated Use Case: The Needle in the 100MB Haystack

We recently validated a high-stakes scenario involving a common evasion tactic used by modern attackers. Imagine a user attempting to download a large 100MB archive. To bypass standard security, the attacker has buried a small, malicious executable inside a massive ZIP file filled with benign data.

 

The Flow of Prevention

1. Seamless Connection: The user is connected via Prisma Access using an Explicit Proxy configuration.
2. The Download Attempt: The user initiates a download of a 100MB ZIP file.
3. Instant Intelligence: Unlike traditional systems that might bypass large files or wait for a full download to scan, the EP Advanced File Handling engine identifies the threat immediately.
4. Deep Inspection: The system doesn't just look at the ZIP file as a whole. It intelligently isolates the individual components.
5. Targeted Isolation: In our validated demo, the engine isolated a 10MB malicious executable buried at the very end of the archive, surrounded by 9 other benign 10MB files.
6. Immediate Block: Because this specific malicious hash had been previously analyzed in the WildFire sandbox, a verdict was available within seconds. The download was blocked instantly before it could reach the user's device.

Please see the demo here: 

 

Visibility and Analytics in Strata Cloud Manager (SCM)

Security isn't just about blocking; it's about understanding. With the Advanced WildFire dashboard in SCM, admins gain unprecedented visibility:

• High-Level Summaries: Quickly see which ZIP, PE, and script files have been identified as malware across your environment.
• Deep Dive Hash Search: Admins can pull specific file hashes to see exactly why a file was convicted.
• Behavioral Evidence: In our demo, the sandbox revealed clear malicious patterns for the isolated 10MB executable, including suspicious registry modifications, unauthorized process spawning, and dangerous API activity.

 

The Bottom Line

EP Advanced File Handling is purpose-built for enterprise proxy scenarios where security efficacy cannot be sacrificed for performance. By moving inspection to a cloud-native, real-time engine, we achieve a target efficacy of >95% across 60+ file types, ensuring that zero-day threats never enter your network.

Ready to see it in action? Contact your account team to learn more about enabling EP Advanced File Handling for your Prisma Access environment.