File Blocking - .exe vs .exe

[raji_toor]

I was testing file blocking before implementation and .exe does not get entirely blocked. 2 different exe files, one from microsoft does not get blocked while another from nirsoft gets blocked. Is there a difference to what kind of exe files get blocked. 

And what about other filetypes do they also behave same.

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer

http://www.nirsoft.net/utils/wireless_network_view.html

[raji_toor]

anyone ??

[Feldiasti · Accepted solution]

as per you'r inputs its seems Palt Alto Firewall is able to block files over none-secured connection and block files from this site:

http://www.nirsoft.net/utils/wireless_network_view.html

and not able to block files over encrypted traffic

https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer 

did you using Outbound SSL Decryption (SSL Forward Proxy)?

 if Yes:  In case you'r using SSL Decryprion, the firewall proxies outbound SSL connections by intercepting outbound SSL requests and generating a certificate on the fly for the site the user wants to visit. The validity date on the PA-generated certificate is taken from the validity date on the real server certificate, and the decrypted data can be inspected for threats, URL filtering, file blocking, or data filtering. Decrypted traffic is never sent off the device.

[raji_toor]

I missed the fact it was ssl session with microsoft. No we don't decrypt outbound as of now.

[Feldiasti · Accepted solution]

Yes it’s true if don’t using outbound-ssl decryption police then you will not be able to blocking file downloaded over ssl connection.