Sandboxing Prefilters

Hi, After an AV scan, static scan and community cloud query steps a VM is launched in order to analyze the runtime behaviour of a sample (=sandboxing scan). This last step is time and resource intensive. Prefiltering is an additional step in which the FortiSandbox decides whether it is worth launching a VM for further analysis: does the provided sample seem suspicious or not? If the sample is marked as non-suspicious by the prefilter, the file will be labelled as clean and it will not be sandboxing scanned. Otherwise it will be sandboxing scanned. In case the FortiSandbox is processing mail attachments, web traffic etc. most files received by the FortiSandbox will most likely be marked as non-suspicious and activating prefiltering will indeed result in a huge performance boost. I assume the first static scan checks for known malicious behaviour. The prefiltering scan tries to identify possible suspicious behaviour. For a PDF-file this might be the presence of JavaScript, forms, /OpenAction-object, ... For office files the presence of macros might be sufficient.

Drawback (security impact) is that the prefilter might be wrong and a malicious sample will be identified as non-suspicious and will not be admitted to a full sandboxing scan. Hence it will not be detected by the FortiSandbox.

In the environment I manage activating prefiltering on some file types resulted in (almost) no more queued samples and, thanks to higher VM-availability, faster detection of malicious content.

Regards, Peter