How to block Wechat File Transfer?

[junwei]

Hi guys,

Wechat had a recent feature update, that grants the user the ability to transfer files from desktops to the other parties.

I would like to block this feature, but yet retain in/out of videos & pictures, or even better, allow incoming file transfer but not outgoing.

I checked the Control Lists, and failed to find an option/signature to block this File Transfer, only Video or Picture Transfers.

Any guys has an advice on how to go about this? Or do I have to block Video and Picture transfers totally?

[hmtay_FTNT]

Hello junwei,

Can you add this custom application control signature and set it to Block? 

F-SBID( --name "WeChat.FileTransfer_Custom"; --protocol tcp; --flow from_client; --app_cat 1; --service HTTP; --parsed_type HTTP_POST; --pattern "/upload"; --context uri; --within 20,context; --no_case; --pattern "ver"; --context body; --no_case; --pattern "weixinnum"; --context body; --no_case; --pattern "authkey"; --context body; --no_case; --pattern "filetype|00 00 00 01|5"; --context body; --no_case; --distance 0; --weight 30; )

You do not have to block Video of Picture. This should block any non-video or picture files. 

HoMing