How to find Threat Detected in Network Transfer - Firepower

[sysad43]

Im having trouble with one user working and saving a word document to our file server over VPN. Firepower keeps blocking it as malware, but looking at the file there is no obvious signs of malware. Firepower doesnt appear to give me any reason why it thinks its malware. In event log, there is nothing under detection name. 

I am adding it to the clean list, but the user is making new doc files based on a template file, and each time the new file gets flagged. Ive checked the template and new files and there no reason for it to be malware. What do I do?

[Mohammed al Baqari]

Hi,

How you concluded that its blocked by firepower if you aren't seeing the
logs.

If it's blocked by FTD, there has to be a file event or IPS event. From
their you can find the reason of blocking. It can be an outdated signature
which isn't applicable to your environment (then you can disable it), or
incorrect disposition, etc

>From CLI use 'system support trace', simulate the file copy and see if it's
blocked by FTD from CLI. If so, ensure that the matched rule is having
logging enabled to findout the matched signature or disposition.

***** please remember to rate useful posts

[sysad43]

It is in the logs. I said there is nothing under detection name column in the log entry. We only have one file policy which is pretty much default.

[Mohammed al Baqari]

Hi, what is the configuration of the file policy assigned to the matched acp rule? Post that.

[sysad43]

[Mohammed al Baqari]

Hi,

Very likely it's detected by dynamic analysis. To comfirm that try to use
the cli command I gave earlier and see the outcome of file policy scanning.

Back to your problem, try to upload the file virusTotal to get a score for
it. Also, try to put it in CyberChef to see if there are hidden macros
causing this.

Once the malicious component is identified, you can clear it through
various tools. Your user can then use the clean version of the template.

[sysad43]

Im not able to run the command. Command not found. Maybe because thats for FTD, and Im running FPMC?