Whitelist exe files within blocked file type

[Bernhard]

Hi,

i have a strange behaviour with whitelisting of some exe files in AV.

Anti Virus is configured to block every exe file

Now i want to exclude some exe files for donwloading. For example:

• https://www.google.com/dl/release2/chrome/acgsruzbtvhdne7br6jxuvefzfbq_98.0.4758.102/98.0.4758.102_9... 
• http://dl.google.com/release2/chrome/acgsruzbtvhdne7br6jxuvefzfbq_98.0.4758.102/98.0.4758.102_98.0.4... 
• https://dl.google.com/release2/chrome/acgsruzbtvhdne7br6jxuvefzfbq_98.0.4758.102/98.0.4758.102_98.0....

I tried these without luck:

• I calculated MD5 of each file and added it to Whitelist Files under Threat Tools and added them in a rule in Global Exceptios
• I clicked add exception ... in the log window of the blocked file. This creates an exception rule

But both versions didn´t work, the files are still blocked with "Forbidden Filetype" in Anti-Virus.

Any ideas?
Is whitelisting within blocked file type working at all?
I couldn´t find any further information about this behaviour ....

BR,
Bernhard

[Timothy_Hall]

I'm not 100% on this, but based on how passive streaming works the file header (magic number) will be encountered first.  If you are set to block EXE files that match (and block) will occur before the entire file has been seen and a MD5 calculated for possible matching against your whitelist.  Assuming this is the case, I can think of a couple of possible workarounds:

1) Enable Deep Scanning for the exe file type only, but be warned that this may dramatically increase CPU load on the firewall depending on how much traffic you are inspecting with Anti-Virus.  Deep Scanning will force the entire file to be streamed, reconstructed and then scanned.  This may avoid the file being dropped early before the whitelist MD5 can be matched, but I don't think you will be able to block all other exe's.

2)  Try creating a custom indicator MD5 signature for the file, although I'm not sure if these are matched before the file header check.  See the "Indicators" section of sk92264: ATRG: Anti-Bot and Anti-Virus

[Bernhard]

Hi Timothy,

i think you are right!

By now, i haven´t found a way to whitelist blocked exe files 😞

No output from opened TAC case ...

Custom indicator didn´t work. Maybe because your assumption "2", that blocking according magic header happens before MD5 hash check, is the reason.