Custom Signature

[Manseer pk]

Hi Team, I have requirement is to block the .txt file coming from outside through mail. The file with only spesific name like Cisco.txt Is ther anyway we can do in ips appliance ? Please help

[Saurav Lodh]

You have create one sig for service type: smtp, and for file attachment match a regex [Cc][Ii][Ss][Cc][Oo][.][Tt][Xx][Tt]

refer

http://www.cisco.com/web/about/security/intelligence/ips_custom_sigs.html