Blocking a user in trusted zone from downloading files on the internet with macros

[dromanelli]

Hey Guys,

So Follow me on this scenario if you would: User on their corp PC behind the trusted interface of the Palo goes to their personal web-based email, opens a bad email, and downloads a file with macros in it. How do I stop that, because the stateful function of the firewall will auto-permit the return traffic (in this case, the macro file) from the internet back through the untrust interface of the firewall and back to the user. That's a problem, obviously. Is there a way to set exceptions to the stateful function? For example: "All traffic sourced from the inside is auto-permitted back through the firewall UNLESS, it contains a macro?"

[mivaldi · Accepted solution]

"the stateful function of the firewall will auto-permit the return traffic" this is only true if you enable DSRI in the security policy, otherwise the firewall will inspect both c2s and s2c flows.

If the user checks their personal email, the traffic will be TLS encrypted, so you need to enable SSL decryption for the firewall to inspect the file download.

The file will be inspected by the Antivirus engine and if there is a match, the file will be blocked.

If it is not a match, it is useful to have a WildFire Analysis Profile in the policy as well, so that the file will be sent to WildFire for sandboxing. It may not block the file, but at the very least, you will receive a report in your WildFire Submission Logs indicating that a malicious file that wasn't blocked has been observed in transit to the user.

If the user runs Cortex XDR Endpoint protection, and a malicious verdict was made by WildFire before the user opens the file, then there is the likelihood that you may be able to stop execution with Cortex XDR Endpoint.

Otherwise, not allowing Macros to auto-run is always a good idea.