Block file based on objects
In some use cases, the sanitized file can't be used dues to an integrity check. We recommend to block file based on objects to prevent zero-day attack. To configure this feature, please follow these steps
- Workflow Manageement > Workflows > Workflow name > Advanced > Enable Block file if containing
- Enable the Object types you want to block and which file families should be blocked
If a file contains the blocked objects, MetaDefender Core will block the file with a new verdict - Blocked Verdict by Deep CDR - an example JSON result
"process_info": { "archive_handling_details": {}, "blocked_reason": "Blocked Verdict by Deep CDR", "blocked_reasons": [ "Blocked Verdict by Deep CDR" ], "file_type_skipped_scan": false, "hash_time": 0, "post_processing": { "actions_failed": "", "actions_ran": "Sanitized", "converted_destination": "Test_sanitized_by_OPSWAT_MetaDefender_85fd41ae04704eab83895dd2e6a46685.docm", "converted_to": "docm", "copy_move_destination": "", "sanitization_details": { "description": "Sanitized successfully.", "details": [ { "action": "removed", "count": 1, "object_name": "macro" } ], "result_template_hash": "101e1f24371ac0133dcb46d3e801833230c9bbfec3db03b2bb62abc26e2a72c3", "sanitized_file_info": { "file_size": 10824, "sha256": "ef09bf23546890751f888f2dc9f1cdcb21682597aea3d73a36d4b0fd4a5c8964" }, "verdict": "blocked", "verdict_explanations": [ "contain macro" ] } }Supported Category and File Family
| Object category | Included Object | Applicable file families |
|---|---|---|
| Script Object | Macro | Microsoft Office Word Microsoft Office Excel Microsoft Office Powerpoint Open Document Hancom Ichitaro Markup Image Visio CAD |
| JavaScript | Markup Image Video | |
| Script (Shell script, Script command) | Markup Video | |
| Document Open Action | ||
| Page Action | ||
| DDE | Markup Microsoft Office Word Microsoft Office Excel RTF | |
| VSTO macro | Microsoft Office Word Microsoft Office Excel | |
| Embedded Object | Embedded object | Markup Visio RTF Ichitaro Hancom Open Document Microsoft Office Word Microsoft Office Excel Microsoft Office Powerpoint |
| Embedded font | Microsoft Office Word Microsoft Office Powerpoint Open Document Hancom Ichitaro RTF | |
| Embedded image | Markup Image | |
| Embedded html | RTF | |
| Attachment | ||
| OLE presentation | Hancom Microsoft Office Word Microsoft Office Excel Microsoft Office Powerpoint | |
| OLE | Microsoft Office Word Microsoft Office Excel Microsoft Office Powerpoint Hancom Open Document Ichitaro RTF Visio ONE | |
| ActiveX control | Microsoft Office Word Microsoft Office Excel Microsoft Office Powerpoint | |
| Binary data | Hancom Microsoft Office Word Microsoft Office Excel Microsoft Office Powerpoint | |
| Recursive object | ||
| External Content | External image | Image Microsoft Office Word Microsoft Office Excel Microsoft Office Powerpoint Hancom Open Document |
| External video | Microsoft Office Word Microsoft Office Powerpoint Hancom | |
| External content | Microsoft Office Word Microsoft Office Excel | |
| External attachment | Markup | |
| External sheet | Microsoft Office Excel Hancom | |
| Hyperlink | Hyperlink | Microsoft Office Word Microsoft Office Excel Microsoft Office Powerpoint Open Document Hancom Ichitaro Markup Visio RTF Text ONE |
| Suspicious object | Suspicious stream (Suspicious streams in OLE structure, e.g., \u0005SebiesnrMkudrfcoIaamtykdDa in XLS or DOC_INFO in HWP.) | Microsoft Office Excel Hancom |
| Suspicious node (Suspicious nodes like datastore or nodes starting with bin in RTF structure.) | RTF | |
Suspicious CDATA (CDATA nodes in XML structure.) | Markup Image | |
| Other risks | ActiveX command | Microsoft Office Powerpoint |
| ppaction protocol | Microsoft Office Powerpoint |
Supported file type in file family
| File family | Supported File type |
|---|---|
| Microsoft Office Word | doc, dot, docx, dotx, docm, dotm |
| Microsoft Office Powerpoint | ppt, pps, pot, pptx, pptm, ppsx, ppsm, potx, potm, sldx, sldm, ppam |
| Microsoft Office Excel | xls, xlt, xlsx, xlsm, xlsb, xltx, xltm |
| Markup | xml, twb, html, hta, ics, csv, tsv |
| Image | svg |
| RTF | rtf |
| Video | wmv |
| pdf, ai | |
| Text | txt |
| CAD | dwg, dwt, dws |
| Open Document | odp, otp, ods, ots, odt, ott |
| Visio | vdx, vtx, vsx, vsdx, vstx, vssx, vsdm, vstm, vssm |
| Hancom | show, cell, hwp, hwt, hwpx |
| Ichitaro | jtd, jtdc, jhd |
| ONE | one |