ESA not detect executable file in GZ archive

[Oleg Volkov]

Hello.

ESA not detect executable file in GZ archive, what can I do it?

Thank You!

[balaji.bandi]

i believe by default .gz not part of the list. as per the 9-53 page :

https://www.cisco.com/c/dam/en/us/td/docs/security/esa/esa8-5-6/ESA_8-5-6_User_Guide.pdf

So you need to configure as below as per page 9-33.

Attachment Filenames and Single Compressed Files within Archive Files (page 9-33)

This example shows how to match single compressed files in archives such as those created by gzip:

quarantine_gzipped_exe_or_pif:
if (attachment-filename == '(?i)\\.(exe|pif)($|.gz$)') {
quarantine("Policy");
}

[Oleg Volkov]

What do it is regexp ? find files like Fileneme.exe.gz ?

This is not help with filtration viruses in gz archive.

[balaji.bandi]

it checks inside any Zip file and scan them.