topic Re: SMTP Emulation in Firewall and Security Management

SMTP Emulation

chico — Thu, 16 May 2019 09:00:12 GMT

Hello everybody,
I'm new in the checkpoint devices and I have a question about the SandBlast for smtp.
Recently checkpoint blocked an attachment to a customer document. It was a word (.doc) document and after looking the logs I can see that the document was bloqued to protection name "Exploited doc document"

If I look the forensic details I can see that the vulnerable operating systems was for (as shown on the attachement file)
-Win7
-WinXP

So if I use a Windows 10 operating syseme, can I dowload the document serently ?

Regards,

Re: SMTP Emulation

TP_Master — Thu, 16 May 2019 20:14:08 GMT

Hi chico,
Welcome!

No, usually when a file is malicious on one OS it is also malicious on others. The reason we use these images (XP & 7) is that they are the most common and therefore attackers usually make their malware run on them. In the sandbox we want to entice the malware to run. But it doesn't mean that Windows 10 is secured against this file.

Re: SMTP Emulation

chico — Tue, 21 May 2019 08:57:09 GMT

Hello,

Thank you for your answer.

Do you know how to create an alert by mail or syslog when an critical smtp Emulation event arrive ? I don't find anything about that in the smartEvent.

Regards,

Re: SMTP Emulation

TP_Master — Wed, 22 May 2019 15:20:42 GMT

Are you able to create SME reaction / e-mail alert on Threat Emulation events in general? just don't know how to filter by Critical severity & SMTP?

Re: SMTP Emulation

chico — Thu, 23 May 2019 07:50:38 GMT

Hi,

I'm able to create reaction but I don't know how to filter by critical severity and SMTP protocole.

Regards,