Custom Application by wireshark raws data pattern?

[Happy__]

Hi team,

I try to create a custom signature with Wireshark raw data pattern, but it's not working.

Scenario:-I have an FTP server and I  download two files from the FTP server and capture this in Wireshark and create a signature with one file raw data. I want when next time when I download the same file from the FTP server it should be blocked by my custom signature.

[PhoneBoy]

Maybe just create a file hash IOC using the AV blade instead?

[Happy__]

Yup, I know we can do with AV & IPS, but the requirement is to do with the application signature tool. 

[G_W_Albrecht]

Wrong tool:

Signature Tool for Application and URL Filtering Administration Guide | 5 Introduction

Check Point Signature Tool lets you create Application and URL Filtering for your own or third-party applications. This tool expands your local Application and URL Filtering Database for applications and URLs that you add. Application and URL Filtering detects and enforces your policies on added signatures as with Check Point defined signatures.

For preventing downloads we use AV.

[Happy__]

In the application signature tool, there is an option that we can create a signature with raw data. So I was just trying to block a specific file with the file raw data.

[G_W_Albrecht]

That imho is a misunderstanding - APCL and URLF deal with URLs and Applications that communicate using the internet. What you want to achieve is to prevent downloading malware, a job done by AV and TE / TX. Custom Applications get defined to enable, disable or limit their internet traffic in APCL rulebase.