block files with multiple level of compression

[azwicker]

I want to block all kind of compressed files with more than the support 2 levels of compressions. Is this possible?

[mikand]

You mean like an arj within a rar within a zip?

[knarra1 · Accepted solution]

PAN performs a maximum of 2 levels of decompression

IPS Scanning of Compressed Files

[azwicker]

I know that the pa supports only 2 levels. My question was: Can i block files with more than 2 levels? In a test scenario, a exe file within a multiple zip file was not sent to wildfire.

[azwicker]

Manually unpacking the file und uploading the exe to wildfire revealed a 0day infected file.