Prevent malicious files from being written to the file system using SBA

[Olga_Kuts]

How can I prevent malicious files from being written to the file system using a Threat Emulation blade of SandBlast Agent? In policies, I can only specify whether to emulate these files or not. 

[PhoneBoy]

Files have to be downloaded in order to be sent to Cloud or Local Emulation.

I know that SandBlast Agent for Browsers has a control as to whether the files are kept afterwords or not: Where does Threat Extraction SandBlast Agent for Browsers save original files 

[Lior_Arzi]

As Dameon wrote, Threat Extraction & Threat Emulation in the SBA browser extension will prevent the malicious files from getting to the disk.

SBA browser extension is an integral part of the Sandblast Agent installation you have.

[nagaraja_cs]

Hi ,

If I copy the malicious file to the system through USB,what will be the case ?

Will that file be removed or we can't ?

[Gal_Carmeli]

Hi,

In this case, the local copy of the file will be removed, but the file on the USB will remain.

Thanks,

Gal

[nagaraja_cs]

Hi Gal,

Thanks for the reply.

How we can remove the file from the system ?

[Gal_Carmeli]

If you want the file to be deleted from the usb, you need to trigger on the file itself. If you double click the file on the usb drive and the trigger will be directly on that file, it will be deleted.

Thanks,

Gal

[nagaraja_cs]

Hi Gal,

I don't want to delete the file from the USB.

I want it to be deleted from the local PC,how we can delete this malicious file automatically from Sandblast when the verdict is malicious.

[PhoneBoy]

As noted in previous comments, it should not be written to the local system in the first place, so it should not need to be deleted.

Even in the case where the SBA Plugin downloads a file to send it to emulation, it is not done in a user accessible location.

Only if the file is deemed safe it is written to a user accessible location.

[Lior_Arzi]

when you copy a file from USB to the local PC it is automatically sent in parallel to Threat Emulation cloud (TE).

if TE returns a malicious verdict (between a couple of sec and a couple of min, depends on the scenario), SBA will immediately delete the file.

SBA does not block the copy itself until the verdict returns. this is in order to provide a smooth user experience as the TE result can take up to a couple of min. the file is accessible immediately and is getting deleted only when a malicious verdict received from TE.

[Chris_Butler]

What are some other vectors from which a file written to the filesystem will be emulated (in parallel) not including downloading with a browser?

Save As attachment from an email in the Desktop Version of Outlook 2013?

Copying files from a file server within the same Active Directory domain to the local PC?

Creating a new Excel Document in the desktop version of Excel 2013 and doing a Save As?

Files written by a backup application like Storage Craft ShadowProtect, backup process running on one server, writing the .bkf file to another server which hosts a local backup file structure, and external backup drives, etc?

[PhoneBoy]

My understanding is, assuming it is a file type we support emulation for, it would apply to all of those.