Advice on blocking the 'EXTENSION PACKS for Oracle Virtual Box

[Rick_Miller]

Oracle's Virtual Box is free and available to use under the GPL v2 license terms.

They have Extension Pack which is not free and can invoke a software audit if found. 

We are looking to see if anyone has an application snippet to prevent download of the Extension Pack. 

Unfortunately the download is a typical download in that it is available from multiple sources

[nikoolayy1]

Better consider trying DLP and the file name or even better Palo Alto XDR or another EDR solution and uploading the file hash so that it is blocked.

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/investigation-and-respo...

https://www.youtube.com/watch?v=Wt6y1jcREcI

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/investigation-and-response/...

Also see this discussion:

https://live.paloaltonetworks.com/t5/custom-signatures/cortex-xdr-block-file-execution-based-on-ico-...

Hope this helps 🙂

[nikoolayy1]

Hello @Rick_Miller , Did you manage to find a solution to this issue?

[Rick_Miller]

continue to ask for an application code like what was provided for malwarbytes