Exe file blocking using custom IPS Signature

Forum|Forum|7 years ago
March 19, 2019
2 replies
6849 views

I've configure fortigate firewall NGFW in flow mode , i need to block exe download using custom IPS signature.

Please can anyone help to write custom ips signature for blocking exe download.

ESarac

New Member

I also need help with this exact problem please. While I found some documentation on how to create a custom IPS signature, it looks complex and syntax is very picky:

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/IPS/Creating%20a%20custom%20signature%20to%20block%20access%20to%20example.com.htm

Based on the above example, I attempted to create a custom signature to try to block one executable (Winzip):

F-SBID ( --name "Block Executables"; ‑‑pattern "winzip24-home.exe"; ‑‑service HTTP; --protocol tcp; --no_case; ‑‑flow from_client; ‑‑context host; )

However, I can't even save the query as I keep getting "Failed to save changes". Some investigation pointed me to needing to use a "category" option but I have no idea what category I would even use.

ede_pfau

SuperUser

IMHO IPS is the wrong tool for this. Use Data Leak Prevention (DLP) instead.

Instead of the default application of preventing data transfer from inside to outside, you can use it to prevent transfers in the opposite direction as well. For this, use it in the policy from LAN to WAN (as download sessions are initiated from the LAN).

First, enable DLP menu item in System>Features.

Then create a DLP sensor, containing a DLP filter (the concept is similar to IPS).

I was happy to see that the DLP can scan data and detect file types instead of looking at the file name/extension only. So I created a filter to block "Executable (exe)" and "Windows Installer Package (msi)".

This works for *.msi files. You can check the correct detection in the logs.

BUT...

for executables, the file type is detected as "Unknown", and thus transfers are not blocked.

If I add a filename pattern of "*.exe", transfers are blocked. But we all agree that this can be circumvented too easily.

All of this in v6.0.6. Maybe one of you has got an idea why this important file type is not detected.

Sign up

Login with SSO

Login to the community

Login with SSO