topic Re: Prevent malicious files from being written to the file system using SBA in Endpoint

Prevent malicious files from being written to the file system using SBA

Olga_Kuts — Mon, 31 Jul 2017 12:06:32 GMT

How can I prevent malicious files from being written to the file system using a Threat Emulation blade of SandBlast Agent? In policies, I can only specify whether to emulate these files or not.

Re: Prevent malicious files from being written to the file system using SBA

PhoneBoy — Mon, 31 Jul 2017 15:55:37 GMT

Files have to be downloaded in order to be sent to Cloud or Local Emulation.

I know that SandBlast Agent for Browsers has a control as to whether the files are kept afterwords or not: Where does Threat Extraction SandBlast Agent for Browsers save original files

Re: Prevent malicious files from being written to the file system using SBA

Lior_Arzi — Thu, 03 Aug 2017 18:54:12 GMT

As Dameon wrote, Threat Extraction & Threat Emulation in the SBA browser extension will prevent the malicious files from getting to the disk.

SBA browser extension is an integral part of the Sandblast Agent installation you have.

Re: Prevent malicious files from being written to the file system using SBA

nagaraja_cs — Fri, 04 Jan 2019 12:09:00 GMT

Hi ,

If I copy the malicious file to the system through USB,what will be the case ?

Will that file be removed or we can't ?

Re: Prevent malicious files from being written to the file system using SBA

Gal_Carmeli — Fri, 04 Jan 2019 12:39:52 GMT

Hi,

In this case, the local copy of the file will be removed, but the file on the USB will remain.

Thanks,

Gal

Re: Prevent malicious files from being written to the file system using SBA

nagaraja_cs — Fri, 04 Jan 2019 12:57:20 GMT

Hi Gal,

Thanks for the reply.

How we can remove the file from the system ?

Re: Prevent malicious files from being written to the file system using SBA

Gal_Carmeli — Fri, 04 Jan 2019 17:52:28 GMT

If you want the file to be deleted from the usb, you need to trigger on the file itself. If you double click the file on the usb drive and the trigger will be directly on that file, it will be deleted.

Thanks,

Gal

Re: Prevent malicious files from being written to the file system using SBA

nagaraja_cs — Sat, 05 Jan 2019 04:54:15 GMT

Hi Gal,

I don't want to delete the file from the USB.

I want it to be deleted from the local PC,how we can delete this malicious file automatically from Sandblast when the verdict is malicious.

Re: Prevent malicious files from being written to the file system using SBA

PhoneBoy — Sat, 05 Jan 2019 07:24:12 GMT

As noted in previous comments, it should not be written to the local system in the first place, so it should not need to be deleted.

Even in the case where the SBA Plugin downloads a file to send it to emulation, it is not done in a user accessible location.

Only if the file is deemed safe it is written to a user accessible location.

Re: Prevent malicious files from being written to the file system using SBA

Lior_Arzi — Sat, 09 Jan 2021 08:35:40 GMT

when you copy a file from USB to the local PC it is automatically sent in parallel to Threat Emulation cloud (TE).

if TE returns a malicious verdict (between a couple of sec and a couple of min, depends on the scenario), SBA will immediately delete the file.

SBA does not block the copy itself until the verdict returns. this is in order to provide a smooth user experience as the TE result can take up to a couple of min. the file is accessible immediately and is getting deleted only when a malicious verdict received from TE.

Re: Prevent malicious files from being written to the file system using SBA

Chris_Butler — Sat, 11 Sep 2021 16:48:50 GMT

What are some other vectors from which a file written to the filesystem will be emulated (in parallel) not including downloading with a browser?

Save As attachment from an email in the Desktop Version of Outlook 2013?

Copying files from a file server within the same Active Directory domain to the local PC?

Creating a new Excel Document in the desktop version of Excel 2013 and doing a Save As?

Files written by a backup application like Storage Craft ShadowProtect, backup process running on one server, writing the .bkf file to another server which hosts a local backup file structure, and external backup drives, etc?

Re: Prevent malicious files from being written to the file system using SBA

PhoneBoy — Sat, 11 Sep 2021 20:17:08 GMT

My understanding is, assuming it is a file type we support emulation for, it would apply to all of those.