Best Practices attachment Filter

[cyberurmel]

Hi all, 

as i couldnt find it via the attachment filter  / File Info. 

We got the information that a new way to infiltrate someone is to send .one (One Note) attachments. As they are not blocked by Macro i wonder if i can create a new Quarantine for that files. But in the Filter attachments it doesnt exist a file type namend .one 

Just to be sure -- if i would create a filter with  attachment file info contains  *.one? 

Thanks a lot

Regards

Cyb

[Ken Stieers · Accepted solution]

Yes, that is your current solution.
I already put in an Enhancement request to add .one to MS Office files, Macro Detection, Document type, etc.
Its publicly available here: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwe31334

[cyberurmel]

Hi Ken, 

thanks first for reply. One Problem what i found as i did it like above.  In the gui i have now unter rules :

part of it below...but this also hits an attachment name where one its in the name.. where can i edit that with regex?

thanks a lot 

if (attachment-filename == ".one") 

[cyberurmel]

Ok..had a misstake 

now with this it seems to work:

---

@cyberurmel wrote:

Hi all, 

as i couldnt find it via the attachment filter  / File Info. 

We got the information that a new way to infiltrate someone is to send .one (One Note) attachments. As they are not blocked by Macro i wonder if i can create a new Quarantine for that files. But in the Filter attachments it doesnt exist a file type namend .one 

Just to be sure -- if i would create a filter with  attachment file info contains  *.one? 

Thanks a lot

Regards

Cyb

---

attachment-filename == "(?i).one$")

[Dustin Anderson]

some more helpful, we use similar to do this. ours is attachment ends with:

\.(7z|acea|ade|adp|bas|bat|cab|chm|cmd|com|cpl|crt|daa|exe|hlp|hta|img|inf|ins|iqy|iso|isp|jar|js|jse|lnk|lzh|mdb|mde|msc|msi|msp|mst|one|pcd|pif|ppsx|r[0-9][0-9]|rar|reg|rev|scr|sct|shb|shs|tbz|url|uue|vb|vbe|vbs|wsc|wsf|wsh|z)

The big thing you will want to look at is the ESA does regex, so the . is a wildcard without escaping it. \. tells it to match a period.