Exe file blocking using custom IPS Signature

[Mohammed_Khan]

I've configure fortigate  firewall NGFW in flow mode , i need to block exe download using custom IPS signature.

Please can anyone help to write custom ips signature for blocking exe download.

[ESarac]

I also need help with this exact problem please. While I found some documentation on how to create a custom IPS signature, it looks complex and syntax is very picky:

https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/IPS/Creating%20...

Based on the above example, I attempted to create a custom signature to try to block one executable (Winzip):

F-SBID ( --name "Block Executables"; ‑‑pattern "winzip24-home.exe"; ‑‑service HTTP; --protocol tcp; --no_case; ‑‑flow from_client; ‑‑context host; )

However, I can't even save the query as I keep getting "Failed to save changes". Some investigation pointed me to needing to use a "category" option but I have no idea what category I would even use.

[ede_pfau]

IMHO IPS is the wrong tool for this. Use Data Leak Prevention (DLP) instead.

Instead of the default application of preventing data transfer from inside to outside, you can use it to prevent transfers in the opposite direction as well. For this, use it in the policy from LAN to WAN (as download sessions are initiated from the LAN).

First, enable DLP menu item in System>Features.

Then create a DLP sensor, containing a DLP filter (the concept is similar to IPS).

I was happy to see that the DLP can scan data and detect file types instead of looking at the file name/extension only. So I created a filter to block "Executable (exe)" and "Windows Installer Package (msi)".

This works for *.msi files. You can check the correct detection in the logs.

BUT...

for executables, the file type is detected as "Unknown", and thus transfers are not blocked.

If I add a filename pattern of "*.exe", transfers are blocked. But we all agree that this can be circumvented too easily.

All of this in v6.0.6. Maybe one of you has got an idea why this important file type is not detected.