Encrypted files on Sandblast agent

[Giancarlo_Cotta]

Hi

Please, I need to understand whats happen in Sand Blast Agent with encrypted files protected by a password.

I suppose:

1) Encrypted file are considered malicious and not sent to the user.

2) Encrypted file are opened in Threat emulation, but before the emulation is necessary that the receiver user know the             password to open the file. Is necessary to put this password in the configuration of the Sanblast agent or  in    the        configuration of the Threat Emulator to open the file during the threat emulation operation.

One of these is correct? Or there is another one way?

Thanks a lot

Giancarlo

[Vincent_Bacher]

afaik you can block or allow encrypted attachments / files, don't know anything about decryption of those files  

[Giancarlo_Cotta]

Ok, but I cannot understand what is the behavior of the Threat Emulation and Threat Extraction with encrypted files.

All file protected with a password are considered malicious?

All encrypted files are considered malicious always malicious? 

If i need to receive password protected file, but I would like to emulate this file before send the file to end user can the Sandblast emulate this file?

Thanks

[Vincent_Bacher]

Regarding password protected archives there is sk112821

[Charris_Lappas]

Hi,

Support for encrypted archives exist (by scanning the subject or body of email).

Support for password protected documents (technically encrypted with a password) does not and this is where CP should focus.

TE cannot break the password or encryption but once the file is delivered to the endpoint client and the user enters the password, the behaviour of the file should be analysed from the SandBlast Agent. At this point it doesn't.

Thanks,

Charris 

[Giancarlo_Cotta]

Ok, thanks a lot!

Giancarlo

[Giancarlo_Cotta]

How many are the ways to emulate the encrypted archive?

The Threat Emulator wait that the user put the password in the encrypted file. Ok, this is a way to emulate the files.

But...

In sk112821 I can see that is possible to configure a file with passwords to open certain type of files.

I suppose these passwords were previoulsy shared from the sender of the mail with the Threat emulator administrator.

Are the two ways correct or I'm wrong?

Thansk a lot

Giancarlo

[Charris_Lappas]

The sk112821 discuss about password protected archives only i.e ZIP, not password protected files i.e .docx

In regards to SK112821 yes, you need to supply those interesting words before the emulation. One practice is to have a predefined password set for your communications. This is an issue on management but a workable solution.

Unfortunately once a file/archive is password protected/encrypted there are not many options to analyse the content.

Thanks

Charris