topic Re: Custom Application by wireshark raws data pattern? in Firewall and Security Management

Custom Application by wireshark raws data pattern?

Happy__ — Mon, 25 Nov 2019 07:25:58 GMT

Hi team,

I try to create a custom signature with Wireshark raw data pattern, but it's not working.

Scenario:-I have an FTP server and I download two files from the FTP server and capture this in Wireshark and create a signature with one file raw data. I want when next time when I download the same file from the FTP server it should be blocked by my custom signature.

Re: Custom Application by wireshark raws data pattern?

PhoneBoy — Tue, 26 Nov 2019 04:13:18 GMT

Maybe just create a file hash IOC using the AV blade instead?

Re: Custom Application by wireshark raws data pattern?

Happy__ — Tue, 26 Nov 2019 07:49:48 GMT

Yup, I know we can do with AV & IPS, but the requirement is to do with the application signature tool.

Re: Custom Application by wireshark raws data pattern?

G_W_Albrecht — Tue, 26 Nov 2019 08:18:44 GMT

Wrong tool:

Signature Tool for Application and URL Filtering Administration Guide | 5 Introduction

Check Point Signature Tool lets you create Application and URL Filtering for your own or third-party applications. This tool expands your local Application and URL Filtering Database for applications and URLs that you add. Application and URL Filtering detects and enforces your policies on added signatures as with Check Point defined signatures.

For preventing downloads we use AV.

Re: Custom Application by wireshark raws data pattern?

Happy__ — Tue, 26 Nov 2019 08:26:05 GMT

In the application signature tool, there is an option that we can create a signature with raw data. So I was just trying to block a specific file with the file raw data.

Re: Custom Application by wireshark raws data pattern?

G_W_Albrecht — Tue, 26 Nov 2019 15:06:40 GMT

That imho is a misunderstanding - APCL and URLF deal with URLs and Applications that communicate using the internet. What you want to achieve is to prevent downloading malware, a job done by AV and TE / TX. Custom Applications get defined to enable, disable or limit their internet traffic in APCL rulebase.