ESA scanning for executables inside of different archive types

[dpinchukov]

I am trying to quarantine mails with an executable attachments inside of archives. If I create a new content filter to match on executables (attachment-filetype == "Executable") this detects directly attached executable files + executable files in .zip-archives. But it does not detect exe files in .7z or .cab archives. How to enable this check for some other archive types?

--------------

Executable: if (attachment-filetype == "Executable") { quarantine("Policy"); }     

Fri Jan 30 16:40:38 2015 Info: MID 29027572 attachment 'test.zip'
Fri Jan 30 16:40:38 2015 Info: MID 29027572 quarantined to "Policy" (content filter:Executable)
 

Fri Jan 30 16:41:25 2015 Info: MID 29027603 attachment 'test.7z'
Fri Jan 30 16:41:25 2015 Info: MID 29027603 queued for delivery

Fri Jan 30 16:41:40 2015 Info: MID 29027624 attachment 'test.cab'
Fri Jan 30 16:41:40 2015 Info: MID 29027624 queued for delivery

[Mathew Huynh]

From my memory and some tests I've been running on my lab box which is on version 8.5.6;  I believe the system while it can now detect .7z and .cab files, it will not decompress these files to search inside, like it could on .zip and .rar etc when an .exe is imbedded within it.

However I do believe this is still being investigated for further details at this stage.

And from your test, it also reflects what i've seen on my test device.