Attachment Scan Rules

3 replies
434 views

how is working this rule executable_windows??

FortiMail Attachment Scan Rules (executable_windows), was catched this file 1.pdf:( detected by Content Filter, filetype application/javascript filename ABC.js in file ABC2 Integration Document - Phase 1.pdf, attachment scan rule: executable_windows).

but when downloaded that file to scan by Sandbox, the file was clean result??

Any one had same this problem, and was solved?

FortiMail

AEK

SuperUser

It seems this PDF file includes a JS script. While when scanned with Sandbox it founds the script is not harmful.

Your FML's content filter doesn't look for malware, it just block the file when it finds a JS script. Your content filter is just working as it is supposed to do.

Since you have a Sandbox, if you need to allow JS scripts that are embedded in PDF files, then your solution would be to allow JS scripts in the content filter. The Sandbox will do the rest.

AEK

G

GMdamien

New Member

HI, we are having the same problem, a few PDFs are being caught with .js embedded, but we don’t have Sandbox, so is our only options are :
1) not to scan PDFs?
2) manually check each PDFs?

Regards, Damien

AEK

SuperUser

Hi Damien

FML does scan PDF files with JS content but it is signature based.

AEK

Sign up

Login with SSO

Login to the community

Login with SSO