- Products
- Learn
- Local User Groups
- Partners
- More
CheckMates Fifth Birthday
Celebrate with Us!
days
hours
minutes
seconds
Join the CHECKMATES Everywhere Competition
Submit your picture to win!
Check Point Proactive support
Free trial available for 90 Days!
As YOU DESERVE THE BEST SECURITY
Upgrade to our latest GA Jumbo
The 2022 MITRE Engenuity ATT&CK®
Evaluations Results Are In!
Now Available: SmartAwareness Security Training
Training Built to Educate and Engage
MITRE ATT&CK
Inside Check Point products!
CheckFlix!
All Videos In One Space
Hi
Please, I need to understand whats happen in Sand Blast Agent with encrypted files protected by a password.
I suppose:
1) Encrypted file are considered malicious and not sent to the user.
2) Encrypted file are opened in Threat emulation, but before the emulation is necessary that the receiver user know the password to open the file. Is necessary to put this password in the configuration of the Sanblast agent or in the configuration of the Threat Emulator to open the file during the threat emulation operation.
One of these is correct? Or there is another one way?
Thanks a lot
Giancarlo
afaik you can block or allow encrypted attachments / files, don't know anything about decryption of those files
Ok, but I cannot understand what is the behavior of the Threat Emulation and Threat Extraction with encrypted files.
All file protected with a password are considered malicious?
All encrypted files are considered malicious always malicious?
If i need to receive password protected file, but I would like to emulate this file before send the file to end user can the Sandblast emulate this file?
Thanks
Regarding password protected archives there is sk112821
Hi,
Support for encrypted archives exist (by scanning the subject or body of email).
Support for password protected documents (technically encrypted with a password) does not and this is where CP should focus.
TE cannot break the password or encryption but once the file is delivered to the endpoint client and the user enters the password, the behaviour of the file should be analysed from the SandBlast Agent. At this point it doesn't.
Thanks,
Charris
Ok, thanks a lot!
Giancarlo
How many are the ways to emulate the encrypted archive?
The Threat Emulator wait that the user put the password in the encrypted file. Ok, this is a way to emulate the files.
But...
In sk112821 I can see that is possible to configure a file with passwords to open certain type of files.
I suppose these passwords were previoulsy shared from the sender of the mail with the Threat emulator administrator.
Are the two ways correct or I'm wrong?
Thansk a lot
Giancarlo
The sk112821 discuss about password protected archives only i.e ZIP, not password protected files i.e .docx
In regards to SK112821 yes, you need to supply those interesting words before the emulation. One practice is to have a predefined password set for your communications. This is an issue on management but a workable solution.
Unfortunately once a file/archive is password protected/encrypted there are not many options to analyse the content.
Thanks
Charris
About CheckMates
Learn Check Point
Advanced Learning
YOU DESERVE THE BEST SECURITY