About finit

We are receiving some spam e-mails that containing links to zipped exe files with malicious code. All the exe files have in common a series of underscore characters, for example: fattura.pdf_________________.exe or informazioni.pdf____________________.exe We send to Palo Alto Support the exe file for the threat identification by Wildfire, but currently there aren't signatures that recognize it. We try to block the download of the exe file setting up a custom data pattern signature with this Regex: .*(__________.exe) but it doesn't works. We also try .*(__________\.exe) but users can still download it. In security profiles - data filtering we see the alert and block threshold to 1. How can we block the file download? Note that the zip filename and the download path often change, the only common attribute is the underscore characters in the .exe filename. Thanks Matteo ... View more