cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted
Level 7
Report Inappropriate Content
Message 1 of 3

Rule creation for different cycles of the connection

I'm looking to create a very targeted and unique rule where when a certain criteria is met in the response cycle AND another criteria is met in the embedded object cycle, we take action.  Is there a way to accomplish this?

For example: We want to block a zip file (response) that contains a VBS file type in that zip file (embedded object).  If a VBS file is being downloaded outright and not in a zip file, we allow it.  Likewise, if a generic ZIP file is being downloaded, we all it. 

I've got a rule that blocks a file type based on MediaType.FromFileExtension.  However, the cycle when it is determined to be a ZIP file happens in the response cycle.  The content inside of that ZIP file isn't evaluated until the embedded object cycle.  I am not able to create a rule that says, MediaType.FromFileExtension=zip AND MediaType.FromFileExtension=vbs because both criteria won't match on the same cycle. 

Any suggestions are appreciated!

2 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: Rule creation for different cycles of the connection

Hello,

so far I know, this is not possible as every embedded object is a dedicated cycle as you mentioned.

Maybe I do not correctly understand this but why do you want this?
As per:
"We want to block a zip file (response) that contains a VBS file type in that zip file (embedded object)"
Does this mean that you want to allow regular VBS files and only block them if they are embedded in other files such as ZIP?

For example: If you check for Mediatype.FromFileExtension or for MediaType.EnsuredTypes contains VBS, then VBS files will always be blocked. Does not matter if it is a plain VBS file or an embedded object in a ZIP file. In last case, entire connection/download of ZIP will then be blocked even if embedded object 165 is the VBS file.

Regards,
Marcel Kutrieba
Technical Support Engineer
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: Rule creation for different cycles of the connection

Sounds like all you are looking for is this:

Name:
Block embedded VBS files

Rule Criteria:
Cycle.Name equals "EmbeddedObject" AND
MediaType.EnsuredTypes contains application/vbs

Action:
Block

 

Is this correct? This way, VBS files that are the root object will not be blocked, but if they are found as an object embedded in an archive, this rule's criteria will match and block.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community