EN: Threat Emulation & Extraction Deep Dive: The Sandbox Pipeline, Extract Modes & Zero Phishing

jorgeluiznim — Tue, 18 Aug 2026 19:53:48 GMT

Article 6 of the Harmony Endpoint Deep Dives series · A note on management: Harmony Endpoint is cloud-managed (Infinity Portal / Web Management) in most deployments today. The content below follows the cloud model — Threat Emulation, Threat Extraction, Credential Protection and Files Protection all live under the unified Threat Prevention > Web & Files Protection policy. Where an on-premises Management Server behaves differently, that is called out.

Purpose

How does Harmony Endpoint let users open a downloaded document immediately while a sandbox is still detonating the original? This article maps the full zero-day pipeline in the cloud console: the Download (web) Emulation & Extraction options, the per-file-type file actions, Extract Modes, the cloud emulation knobs (size limit, environments, block-on-failure), and the two Credential Protection controls (Zero Phishing and Password Reuse).

Audience

[x] Security Engineers
[x] Endpoint Administrators
[x] SOC Analysts
[x] Beginners
[ ] Experts

Prerequisites

Threat Prevention policy basics in the Web Management console (Article 1)
The Endpoint Security Browser Extension installed. Download (web) Emulation & Extraction is supported on Chrome, Edge (Chromium), Firefox, Brave and Internet Explorer (Windows) and Chrome/Firefox/Brave/Edge (macOS) — not on Safari

Overview

This protection family combines cooperating engines against advanced and zero-day file-borne threats. In the cloud console they sit inside Web & Files Protection (Threat Emulation, Threat Extraction, Credential Protection, Files Protection), with Anti-Exploit under Behavioral Protection:

Engine	What it does
Threat Emulation	Detects zero-day and unknown attacks — files from the endpoint are sent to a sandbox for emulation, catching evasive zero-day attacks
Threat Extraction	Proactively protects users — quickly delivers safe (sanitized) files while the originals are inspected (Content Disarm & Reconstruction)
Anti-Exploit	Detects zero-day and unknown attacks and protects vulnerable processes from exploitation (covered in depth in Article 25)

The Endpoint Security Browser Extension is the front door of the download pipeline.

The Web Download Pipeline

Set the main mode under Policy > Threat Prevention > Policy Capabilities > Web & Files Protection, in the Download (web) Emulation & Extraction section:

Prevent — files are sent for emulation and extraction. This is the protective default.
Detect — emulates the original without suspending access and logs the incident; the file is still blocked if it is malicious or blocked by extension.
Off — no emulation or extraction; supported files are allowed.

ℹ️ Note: Threat Extraction only applies to file types that can be extracted (documents); Threat Emulation only to types that can be emulated (executables, scripts, and many document formats).

Per-file-type file actions

Under Advanced Settings > Threat Emulation > Override Default File Actions > Edit, choose a File action per supported file type:

Option	User experience
Prevent	Sent for emulation/extraction. Sub-options below decide the copy behavior
Allow	All supported files allowed without emulation (overrides Prevent)
Detect	Emulates without suspending access and logs; blocked only if malicious or blocked by extension
Off	Allow file; no emulation or extraction

When Prevent is chosen, the copy behavior comes from the Supported Files sub-options:

Get extracted copy before emulation completes — the system appends .cleaned to the file name and delivers it immediately (see Extract Modes below).
Suspend download until emulation completes — the user waits; if benign the original is delivered, if malicious a Block page appears. More security, more delay.
Emulate original file without suspending access — the original goes to the user immediately (even if it later turns out malicious).

For Unsupported files (types that can be neither emulated nor extracted), go to Advanced Settings > Download Protection > Unsupported Files and choose Allow or Block; per-extension overrides are available.

Extract Modes

When files are extracted, choose the sanitized format:

Extract potential malicious elements — same file type, with the selected malicious parts (macros, JavaScript, etc.) removed.
Convert to PDF — converts the file to PDF, keeping text and formatting.

✅ Best Practice (from the guide): for PDFs in right-to-left languages or Asian fonts, prefer Extract potential malicious elements so those files are processed correctly.

Files Protection (file system)

Beyond web downloads, Files Protection covers files on disk, with two components:

Anti-Malware Mode — Prevent / Detect / Off (Detect logs but the malware stays executable — use with caution).
Files Threat Emulation Mode — Prevent (detects a malicious file, logs the event and deletes the file), Detect (detects and logs only), or Off. Supported on client E86.80 and higher.

Logging: Threat Emulation / Extraction events appear in the Logs view (filter by the Threat Emulation blade). Open an event's Card to see Forensic Details (including a macro's hash for exclusions).

The Cloud Sandbox: Size, Environments & Fail-Handling

In the cloud model, emulation runs in Check Point's cloud sandbox. The knobs that matter are all under Advanced Settings > Download Protection:

Maximum file size (Emulation Environments > Upload and emulate files under😞 client E86.40 and higher supports up to 100 MB; older clients up to 15 MB. Larger limits mean more client processing and network traffic.
Emulation Environments: Use Check Point recommended emulation environments (default), or select specific OS images — the latter only when configured from SmartConsole.
Block on failure: Block downloads when emulation fails due to size limit or connectivity problem, and …due to file encryption — decide whether a file that can't be emulated is blocked or allowed.

The Sandbox's Real Enemy: Evasion

A sandbox only works if the malware doesn't realize it's in a sandbox. Modern samples check for tell-tale artifacts — Is there mouse movement? Real documents? Days of uptime? VM drivers? — and if it smells like an analysis environment, they play dead and reveal nothing. Check Point's own research catalogs these tricks in the Evasions Encyclopedia and Anti-Debug Encyclopedia, and ships InviZzzible — a tool whose entire purpose is to measure how detectable your sandbox is.

💡 Why this matters here: it's the case for high-fidelity emulation. Check Point's cloud sandbox is engineered to look like a real user's machine, so evasive samples detonate instead of hiding. Emulation also runs pre-CPU-level inspection to catch exploits before evasive logic even executes.

Exclusions That Don't Backfire

Default behavior: inspect all domains and files. Under Web & Files Protection you can exclude specific folders, domains or SHA1 hashes from Threat Emulation, Threat Extraction and Zero-Phishing.

Domain rules (from the guide):

You enter	Excludes	Does NOT exclude
`www.domain.com`	http/https `www.domain.com` and `domain.com`	`sub.domain.com`
`domain.com`	`www.domain.com`, `domain.com`, all subdomains	—
`sub.domain.com`	`sub.domain.com`	`sub2.domain.com`
`*.domain.com`	subdomains of `domain.com` (e.g. `sub1.domain.com`)	—

Rules of the road:

Domain exclusions: no http/https or special characters except the asterisk *; with or without www is fine; relevant only for the browser extension.
File Reputation exclusions are by SHA1 (Threat Emulation / file system monitoring); from E86.40 SHA1 also excludes downloaded files and local HTML from the extension. Macro exclusions (by the macro's SHA1) are supported on E88.00+.
Folder exclusions: Windows path, no environment variables (e.g. C:\Program Files\MyTrustedDirectory\).
IP format: <X.X.X.X>/<mask> (e.g. 192.168.100.30/24).

⚠️ Warning: excluding a parent domain silently excludes all its subdomains — an over-broad exclusion can drop protection you didn't intend to drop.

Credential Protection: Zero Phishing + Password Reuse

Both live under Web & Files Protection > Credential Protection.

1. Zero Phishing — checks a site's characteristics to verify it is not impersonating another site to misuse personal information. Modes: Prevent (default; user cannot access a phishing site, a log is created), Detect (log only), Off. Advanced options: allow the user to dismiss the phishing alert; send a log on every scanned site; allow the user to abort scans; Scan local HTML files (E86.50+ on Chromium browsers); disable the scan notification (the scan still runs, shown by the yellow highlight around the input field).

2. Password Reuse — Endpoint Security keeps a cryptographic secure hash of passwords used in the Protected Domains (set via Edit > Protected Domains) and compares them against passwords typed elsewhere. Modes: Prevent (default; blocks entering the corporate password on a non-corporate site), Detect (does not block; captures it in the logs), Off. Detect & Alert exists only in older releases and is deprecated by Prevent.

💡 Tip: Password Reuse is one of the most underrated anti-phishing controls — it catches the exact moment credentials are about to leak, even on sites that pass every reputation check.

Best Practices

✅ Best Practice: keep Prevent with Get extracted copy before emulation completes for document-type downloads — users get a safe .cleaned copy instantly, so security doesn't cost them waiting time.

✅ Best Practice: enter domain exclusions without http/https or special characters (only * is allowed), and make each exclusion as specific as the case allows.

✅ Best Practice: decide the block-on-failure behavior deliberately — for high-risk populations, block downloads that fail emulation due to size, connectivity or encryption.

Common Mistakes

Mistake	Impact	Solution
"Emulate original without suspending access" on risky file types	User opens the file before the verdict	Reserve it for low-risk categories; suspend originals for executables
Excluding `domain.com` to fix one subdomain issue	All subdomains excluded	Exclude the specific subdomain, or use a precise pattern
Folder exclusion with `%USERPROFILE%` etc.	Not supported — exclusion doesn't work	Use literal Windows paths
Assuming a "< 10 MB" emulation cap	Larger files silently skip emulation on old clients	On E86.40+ raise the limit (up to 100 MB) and set block-on-failure
Expecting Threat Extraction/Emulation on Safari	Unsupported on Safari	Use Chrome, Edge (Chromium), Firefox or Brave

Troubleshooting

Symptom: Users complain downloads are "stuck" for a while Environment: Download Emulation & Extraction with Suspend download until emulation completes Root Cause: With suspend, users receive nothing until the verdict Resolution:

Switch document categories to Prevent with Get extracted copy before emulation completes — users get the sanitized .cleaned copy immediately
Review the per-file-type overrides for the categories generating complaints
Confirm the file is under the emulation size limit (up to 100 MB on E86.40+) and that block-on-failure isn't blocking legitimate large files

FAQ

Q: What does the user see while a document is being emulated? A: With Get extracted copy before emulation completes, a .cleaned copy of the document immediately. If the original is benign, it is delivered when emulation finishes.

Q: Which files can be extracted vs emulated? A: Extraction applies to extractable types (documents); emulation to emulatable types (executables, scripts, many document formats). Types that support neither are handled under Unsupported Files (Allow/Block).

Q: What are the Extract Modes? A: Extract potential malicious elements (same format, cleaned) or Convert to PDF.

Q: What is the maximum file size for emulation? A: Up to 100 MB on client E86.40 and higher (up to 15 MB on older clients), configurable under Emulation Environments.

Q: Which browsers support Threat Extraction & Emulation? A: Chrome, Edge (Chromium), Firefox, Brave and Internet Explorer on Windows, and Chrome/Firefox/Brave/Edge on macOS. Safari does not.

Q: Where do I see the verdict logs? A: In the Logs view, filtered by the Threat Emulation blade — open the event Card for Forensic Details.

Anti-Ransomware Deep Dive — Article 2 · Read on CheckMates ↗
Anatomy of a Forensics Report — Article 4 (Threat Emulation detections feed Forensics)
Anti-Exploit Deep Dive — Article 25

References

Check Point Harmony Endpoint Administration Guide (cloud / Infinity Portal) — Configuring Endpoint Policy > Web & Files Protection (Download Emulation & Extraction, Credential Protection, Files Protection, Exclusions)
Check Point Harmony Endpoint Administration Guide (cloud / Infinity Portal) — Supported Browsers for the Browser Extension

Revision History

Date	Version	Author	Changes
2026-07-16	1.0	Jorge Luiz	Initial version
2026-07-30	2.0	Jorge Luiz	Cloud-first revalidation against the cloud Administration Guide: Web & Files Protection paths, cloud file actions (Prevent/Detect/Off + sub-options), Files Threat Emulation Mode, cloud sandbox knobs (size up to 100 MB, environments, block-on-failure), multi-browser support, `*` in domain exclusions, Logs view; removed on-prem SmartEndpoint/SmartLog, Harmony Appliance IP/certificate and sk116381, and the unsourced "< 10 MB" cap

Supported Versions: Harmony Endpoint cloud management (Infinity Portal / Web Management), Windows and macOS clients, supported browser extension Last Updated: 2026-07-30

topic EN: Threat Emulation & Extraction Deep Dive: The Sandbox Pipeline, Extract Modes & Zero Phishing in Endpoint