Hi Doris, we tested all the mail attachements with one rule. So in this kind of "file blocking" rule, all executables (so called PE files in PA speek = PE -Microsoft Windows Portable Executable (exe, dll, com, scr, ocx, cpl, sys, drv, tlb)) should be detected. The mails were not encrypted, least of all not with SSL. The communication port was tcp 25 = normal emailexchange between a german freemailer and our mailserver. PA detects correctly the application "smtp" in this data exchange. Exe, dll, com, scr, ocx, cpl, drv were detected correctly, sys and tlb were not detected. The relating rule simple says: alert all data files - please look at the attached gif. So a reg or a cmd file should be detected too. But the reg files was detected never, and the cmd file was only detected, if the filename ends with "*.cmd". What makes me very unhappy is, that there is no file logging, although we haved attached some files at an email. In my humble opinion is an attachement very easy to detect, so why did i got no log entry? The PA art of security seems not to be sufficiently in another point of email communication. If i send an email with javascript in his data body, there is no method in PA to detect and block this code (i tried several data patterns in file blocking or data filtering rules and self designed applications or vulnerabilities). Other security engines like mcafee/webwasher or finjan are able to block such code. Manfred
... View more
