cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2314
Views
5
Helpful
1
Replies

Blocking .exe files in .7z archives

irkutskoil
Level 1
Level 1

Hi

How can i block .exe files in .7z archives omn Cisco ESA?

I have an incoming content filter to block different files in emails

it looks like attachment-filename == "(?i)\\.(tar|gz|exe|lnk|js|dll|msi|scr|jar|hta)$"

It works for zip archives but for 7z it doesn't

1 Accepted Solution

Accepted Solutions

Libin Varghese
Cisco Employee
Cisco Employee

Hi,

We do not currently have visibility into .7z files. The engine is not able to look into inside this file type to see the executable file.

There's already a feature request for supporting the 7z files scanning for the IronPort with Feature request number:


https://tools.cisco.com/bugsearch/bug/CSCzv63760/?reffering_site=dumpcr

Currently the Feature has no work-around for the (7z) files, but the only way that you can block them is by using a filter that blocks the (7z) based on the file-info (file name ends with 7z).

Regards
Libin Varghese

View solution in original post

1 Reply 1

Libin Varghese
Cisco Employee
Cisco Employee

Hi,

We do not currently have visibility into .7z files. The engine is not able to look into inside this file type to see the executable file.

There's already a feature request for supporting the 7z files scanning for the IronPort with Feature request number:


https://tools.cisco.com/bugsearch/bug/CSCzv63760/?reffering_site=dumpcr

Currently the Feature has no work-around for the (7z) files, but the only way that you can block them is by using a filter that blocks the (7z) based on the file-info (file name ends with 7z).

Regards
Libin Varghese

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: