Professional Documents
Culture Documents
Symantec DLP 15.1 Detection Customization Guide
Symantec DLP 15.1 Detection Customization Guide
Prevention Detection
Customization Guide
Version 15.1
Symantec Data Loss Prevention Detection
Customization Guide
Documentation version: 15.1
Legal Notice
Copyright © 2018 Symantec Corporation. All rights reserved.
Symantec, CloudSOC, Blue Coat, the Symantec Logo, the Checkmark Logo, the Blue Coat logo, and the
Shield Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S.
and other countries. Other names may be trademarks of their respective owners.
This Symantec product may contain third party software for which Symantec is required to provide attribution
to the third party (“Third Party Programs”). Some of the Third Party Programs are available under open
source or free software licenses. The License Agreement accompanying the Software does not alter any
rights or obligations you may have under those open source or free software licenses. Please see the
Third Party Legal Notice Appendix to this Documentation or TPIP ReadMe File accompanying this Symantec
product for more information on the Third Party Programs.
The product described in this document is distributed under licenses restricting its use, copying, distribution,
and decompilation/reverse engineering. No part of this document may be reproduced in any form by any
means without prior written authorization of Symantec Corporation and its licensors, if any.
THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS,
REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE
DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY
INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL
DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS
DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO
CHANGE WITHOUT NOTICE.
The Licensed Software and Documentation are deemed to be commercial computer software as defined
in FAR 12.212 and subject to restricted rights as defined in FAR Section 52.227-19 "Commercial Computer
Software - Restricted Rights" and DFARS 227.7202, et seq. "Commercial Computer Software and
Commercial Computer Software Documentation," as applicable, and any successor regulations, whether
delivered by Symantec as on premises or hosted services. Any use, modification, reproduction release,
performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government
shall be solely in accordance with the terms of this Agreement.
Symantec Corporation
350 Ellis Street
Mountain View, CA 94043
http://www.symantec.com
Contents
Index .................................................................................................................... 36
Chapter 1
Introducing Detection
Customization
This chapter includes the following topics:
Custom file type Symantec Data Loss Prevention detects more than 300 file types. However, if the type
identification of file you want to detect is not supported, you can detect it using a custom script. Use
the Symantec Data Loss Prevention Scripting Language to write a script that detects the
binary signature of the particular file format you want to detect.
Note: For a complete list of supported file types, refer to the Symantec Data Loss
Prevention Administration Guide.
Custom script validators Symantec Data Loss Prevention provides you with Data Identifiers to detect file contents.
for Data Identifiers Data Identifiers use validation checks to increase match accuracy and reduce false
positives. Symantec Data Loss Prevention provides more than 35 system-defined Data
Identifier validators. In addition, you can use the Data Loss Prevention Scripting Language
to write your own custom script validators for Data Identifiers.
Note: For more information about Data Identifiers, refer to the Symantec Data Loss
Prevention Administration Guide.
File Type Analyzer The Symantec Data Loss Prevention File Type Analyzer utility helps you determine the
unique bytes of the custom file type you want to detect. You can then use the Symantec
Data Loss Prevention Scripting Language to accurately identify custom file formats.
■ System variables
■ Assert statement
■ If/Else statements
■ Evaluate statement
Feature Description
Custom File Type Signature The DLP Scripting Language lets you write a script that detects the unique bytes
detection of a custom file type.
Custom script validators for Data The DLP Scripting Language lets you write a script to validate patterns in a
Identifiers message.
Note: Symantec Data Loss Prevention may update statement names and may add additional
statement functions.
Using the DLP Scripting Language 9
System variables
System variables
System variables store the data that you can check and manipulate. For custom file type
detection, the script has access to the entire file by the $data variable. For custom validators,
the script has access to the raw message, the normalized message, and the 10 bytes preceding
and trailing the matched data. For custom validators the script does not have access to the
entire message.
Warning: Do not assign values to system variables. These variables already hold system-defined
data. Use a local variable such as $result to assign values. You should not use system
variables with logical, assignment, or arithmetic operations.
$data The script engine creates the byte array $data variable when it reads in a file.
The $data variable stores the entire file.
$match The script engine stores the data that match the pattern in the $match variable
before it is normalized.
$normalizedMatch The script engine stores the normalized matched data in the $normalizedMatch
variable after it is normalized.
$matchPrefix You can use this method to verify if a message starts with a certain pattern. The
methods checks 10 bytes before the matched pattern.
$matchSuffix You can use this method to verify if a message ends with a certain pattern. The
methods checks 10 bytes after the matched pattern.
Assert statement
The Assert statement evaluates a Boolean expression and asserts the value "true" when the
expression returns a match. The Assert statement must end with a semicolon.
The Assert statement supports all regular Boolean expressions:
■ == evaluates to
■ >= greater than or equal to
■ <= less than or equal to
■ > greater than
■ < less than
Using the DLP Scripting Language 10
If/Else statements
If/Else statements
You use the If/Else conditional statement to control the flow of program execution. The If/Else
statement lets you include conditional logic in your script when you need to evaluate the unique
bytes of a complex data set.
The If/Else condition operates the same as conditional statements that other programming
languages provide. The If/Else statement takes a Boolean expression, evaluates it, and alters
the execution of the program based on the result of the expression.
The following example shows one way to use the If/Else conditional statement:
if ($var1 == 3)
{
// statement
// statement
}
else
// statement
The scripting language supports nested execution of the statements that are contained within
the conditional statement. To use nested statements, you use brackets within the scope of an
If/Else statement to offset the multiple script statements.
If the data set you want to evaluate requires more advanced conditional logic, you can declare
multiple If/Else statements nested within each other.
Using the DLP Scripting Language 11
Evaluate statement
Evaluate statement
The Evaluate statement provides a number of functions that you can you use to evaluate data.
Not all functions are available for each feature.
Addition X X
AsciiValue X NO
DataLength X X
Execute+ X x
GetAsciiStringAt X X
GetBinaryIntValue X NO
GetBinaryValueAt X NO
GetHexStringValueAt X NO
GetIntegerAt X X
GetStringValueAt NO X
Modulus X X
Multiply X X
Print+ X x
ReadFile+ X x
Subtract X X
Key:
■ X = Feature supports the statement on server and endpoint.
■ NO = Statement is not supported by that feature.
■ x = Statement is not supported on the endpoint; server-side only.
■ + = Advanced function, requires you to set the system property
"genieScript.ADVANCED_FUNCTION_ENABLED.str" to true.
Using the DLP Scripting Language 12
Evaluate statement functions
Note: To ensure that your scripts run on the server and the endpoint, script values must be
specified in hexadecimal (hex) notation. For example, $int4 =
getBinaryValueAt($data,0x19,2) is proper. However, if the following non-hex value is
specified in an endpoint environment, the script causes the DLP Agent to crash: $int4 =
getBinaryValueAt($data,25,2).
Addition The Addition function takes two values as Add two variables together and returns the
arguments and adds them together. The value in the variable $result.
add
values can be variables or constants. You
$result = add($var1, $var4);
can save the returned result as a variable
or discard the result. Add two constants together but discards the
value.
The Addition function adds two or more
values together and returns the result. The add(1, 2);
values can be variables or constants. You
Add three values together.
can save the returned result as a variable
or discard the result. $result = add($var1, 2, $var4);
Execute (advanced The Execute function allows a user to call $result = execute($string1,
function) methods on any Java objects available as equals, $string2);
variables in the script's computation state.
execute Assuming that a String is saved under the
For example, if you have a String saved
variable $string.
under the variable name $data, you can call
the String's equals method using the execute
function.
GetAsciiStringAt The GetAsciiStringAt function treats the data The variable $data is a byte array with the
as ASCII characters and converts the data values: 'abcdef'.getBytes();
getAsciiStringAt
into a string. The data is converted starting
The result should be abc.
from the specified offset for the specified
number of digits. $result = getAsciiStringAt($data,
0x0, 3);
GetBinaryValuteAt The GetBinaryValuteAt function pulls the The variable $data is byte array with values
byte data into a new byte array based on {(byte)0x59,(byte) 0xAD,(byte) 0x1C,(byte)
getBinaryValueAt
the offset and length specified. The new byte 0xDF,(byte) 0x2B,(byte)0x37}. The $result
array can then be compared to other byte should be a byte array with the byte 0x59.
arrays for equality.
$result = getBinaryValueAt($data,
This function lets you specify how many 0x0, 1);
digits to retrieve from the data (from 1 - 4
bytes). You use this function to analyze data The $data variable is a byte array with values
at specific offsets of a byte array. {1, 2, 3}. The $result should equal a new byte
array with the number 2 in it.
Note: GetBinaryValueAt() returns an array
with the bytes, whereas GetBinaryIntValue() $result = getBinaryValueAt($data,
returns an integer that is composed of the 1);
bytes.
Using the DLP Scripting Language 14
Evaluate statement functions
GetIntegerAt The GetIntegerAt function is similar to The $data variable is a byte array with the
GetAsciiStringAt, except GetIntegerAt values: '12345'.getBytes();
getIntegerAt
parses the ASCII characters, and converts
The result should be 34.
them to an integer value. The data is
converted starting from the specified offset $result = getIntegerAt($data, 0x2,
for the specified number of digits. If a 2);
character is not a numerical value, the script
throws an exception.
GetStringValueAt The GetStringValueAt function pulls the data The variable $data is a byte array with values
into a new character array based on the {(byte)0x59,(byte) 0xAD,(byte) 0x1C,(byte)
getStringValueAt
offset and length specified. The new byte 0xDF,(byte) 0x2B,(byte)0x37}.
array can then be compared to other byte
$result = getStringValueAt($data,
arrays for equality.
0x0, 1);
$result = getStringValueAt($data,
1);
Modulus The Modulus (mod) function returns the mod The result should be 2.
of two parameters. The mod is the
mod $result = mod(5, 3);
remainder of the first parameter divided by
the second.
Multiply The Multiply function takes two arguments $result = multiply(2, 4);
and multiplies their values.
multiply The result should be 8.
The Multiply function takes two or more
$result = multiply(2, 4, 6);
arguments and multiplies their values.
The result should be 48.
Print (advanced function) The Print function takes its arguments, No results to save, but standard out should
concatenates them all together and prints it have the string.
print
to standard out.
print('hello');
Using the DLP Scripting Language 15
Example scripts for custom file type detection
ReadFile (advanced The ReadFile function takes a file that is The $result variable should contain a byte
function) saved as a variable in the computation state. array of the 10 first bytes from the file that is
It reads the specified number of bytes from saved under variable $file.
readfile
the file as a byte array, and returns the byte
$result = readFile($file, 10);
array. This function requires two arguments.
Subtract The Subtract function subtracts the second $result = sub(10, 4);
parameter from the first.
sub The result should be 6.
The Subtract function subtracts elements 2
$result = sub(10, 4, 6, 3);
through N from the first element.
The result should be -3.
$Int1 = getHexStringValue('D0CF');
$Int2 = getBinaryValueAt($data, 0x0, 2);
assertTrue($Int1 == $Int2);
$Int3 = getHexStringValue('ECA5');
$Int4 = getBinaryValueAt($data, 0x200, 2);
assertTrue($Int3 == $Int4);
$Int1 = ascii('V');
$Int2 = getBinaryValueAt($data, 0x0, 1);
assertTrue($Int1 == $Int2);
$Int3 = ascii('CFV');
$Int4 = getBinaryValueAt($data, 0x3, 3);
assertTrue($Int3 == $Int4);
$slash=getHexStringValue('2f');
$epub1=ascii('epub');
$epub2=ascii('zip');
$slash1=getBinaryValueAt($data, 0xb, 1);
assertTrue($slash == $slash1);
$word1=getBinaryValueAt($data, 0xc, 4);
assertTrue($word1 == $epub1);
$word2=getBinaryValueAt($data, 0x11, 3);
assertTrue($word2 == $epub2);
Note: EPUB files are in the open book format (XML) encapsulated in a zip file format. You
cannot test this script using the File Type Analyzer utility because the script detects the
"application/epub+zip" string contained in the manifest file (named "mimetype"). The utility
cannot crack the zip file to read the manifest. However, the detection engine can crack the zip
file and read the manifest. You can implement this script in an instance of the Custom File
Type Signature detection rule and detect EPUB files.
The following script example detects the Amazon Kindle file type:
$book=ascii('BOOK');
$mobi=ascii('MOBI');
$word1=getBinaryValueAt($data, 0x3c, 4);
$word2=getBinaryValueAt($data, 0x40, 4);
assertTrue($book == $word1);
assertTrue($mobi == $word2);
$null=getBinaryValueAt($data, 0x3b, 1);
assertTrue($null == 0);
$nullx=getBinaryValueAt($data, 0x44, 1);
assertTrue($nullx == 0);
The following script example detects the Oracle IRM file type, which is used for Digital Rights
Management (DRM):
$soft=ascii('Soft');
$seal=ascii('SEAL');
Using the DLP Scripting Language 17
Example scripts for custom validators
In addition, the following two tutorials offer additional examples of the scripting language:
■ Java class files
See “Tutorial 1: Detecting Java class files” on page 29.
■ Password-encrypted zip files
See “Tutorial 2: Detecting an encrypted ZIP file format” on page 32.
Parameter Description
Pattern \d{5}
Normalizer Do Nothing
The following custom script validates a 10-character string in the form of LL/MM/DD/YYYY.
The first two characters are the initials of the person and are excluded from validation. The
Using the DLP Scripting Language 18
Example scripts for custom validators
remaining digits are saved into separate variables, computed by a multiplier, and added. Then
they are compared to ensure that they conform to a proper day (less than 32), month (less
than 13), and year (less than 2051).
Parameter Description
Pattern \l{2}\d{8}
Custom Script
$m1 = getIntegerAt($normalizedMatch, 0x2, 1);
$m2 = getIntegerAt($normalizedMatch, 0x3, 1);
$d1 = getIntegerAt($normalizedMatch, 0x4, 1);
$d2 = getIntegerAt($normalizedMatch, 0x5, 1);
$y1 = getIntegerAt($normalizedMatch, 0x6, 1);
$y2 = getIntegerAt($normalizedMatch, 0x7, 1);
$y3 = getIntegerAt($normalizedMatch, 0x8, 1);
$y4 = getIntegerAt($normalizedMatch, 0x9, 1);
The following custom script validator can be used to verify the match of a Turkish ID number.
A Turkish ID is an 11-digit number. The first digit cannot be zero. The 10th and 11th digits are
check digits for error detection.
Using the DLP Scripting Language 19
Example scripts for custom validators
Parameter Description
Pattern \d{11}
Custom Script
$k1 = getIntegerAt($normalizedMatch, 0x0, 1);
$k2 = getIntegerAt($normalizedMatch, 0x1, 1);
$k3 = getIntegerAt($normalizedMatch, 0x2, 1);
$k4 = getIntegerAt($normalizedMatch, 0x3, 1);
$k5 = getIntegerAt($normalizedMatch, 0x4, 1);
$k6 = getIntegerAt($normalizedMatch, 0x5, 1);
$k7 = getIntegerAt($normalizedMatch, 0x6, 1);
$k8 = getIntegerAt($normalizedMatch, 0x7, 1);
$k9 = getIntegerAt($normalizedMatch, 0x8, 1);
$c1 = getIntegerAt($normalizedMatch, 0x9, 1);
$c2 = getIntegerAt($normalizedMatch, 0xA, 1);
■ Increasing the Java heap size for large or recursive data sets
■ View and compare the unique bytes for each file in the data set.
■ Analyze the bytes across files and determine those that are consistent.
■ Test a custom file type detection script.
■ Save and open data set configurations and test scripts.
Figure 3-1 Symantec Data Loss Prevention File Type Analyzer utility interface
Parameter Use
Add Directory This option lets you choose which directories to include in the file analysis. You can add multiple
directories to a single data set.
Each directory you select should contain samples of the file type you want to analyze and ultimately
detect. To have a useful data set, include several samples of the file type, including different versions
of the product with different features enabled and disabled.
Note: To achieve the best results, the recommended minimum sample size is 15 files of the same file
type.
Remove This option lets you remove a directory you have added to the data set. You can select multiple
Directory directories to remove. When a directory is removed, it is no longer scanned as part of the data set.
Using the File Type Analyzer utility 23
Creating the data set
Parameter Use
File Name This field contains a regular expression pattern that tells the utility what files from each directory to
Filter include in the data set. A regular expression is used because it provides flexibility for filtering the files
you want to include in your data set.
The following regular expression reads in all ASCII file names from a directory (or directories) to a
data set:
[\w\s]+.[\w]+
The following regular expression lets you filter file the names that use non-ASCII characters:
[^0x00]+.[\w]+
Note: For assistance with using regular expressions for file name filtering, see the topic "About writing
regular expressions" in the Symantec Data Loss Prevention Administration Guide or in the online Help.
Number of This field specifies the number of bytes per file to display for analysis.
Bytes
The default maximum value for this field is 1024 bytes.
See “Increasing the number of bytes that are analyzed” on page 26.
Chunk Size This field represents the size of the group of bytes to be displayed in a column. For example, if you
enter 2 in this field, the utility displays 2 bytes of data in each column (offset).
Parser Type This option defines how the data is displayed for analysis from the scanned data set.
■ The BYTE option displays the analysis results in hexadecimal format representing the corresponding
byte value.
■ The ASCII option displays the analysis results as ASCII characters.
■ The NUMBER option displays the analysis results in integer format.
Recursive If this box is checked, the utility scans each directory and any subdirectories that are included in the
Scan data set. If a directory contains subdirectories where files you want to scan are located, choose this
option.
Note: Recursive scanning is memory intensive. If you want to analyze either a large or a recursive
data set, consider increasing the Java heap size to improve performance.
See “Increasing the Java heap size for large or recursive data sets” on page 26.
Analyze Click this option when you have completed configuring the data set. The File Type Analyzer utility
Dataset validates the input and initiates the file analysis process. The utility reads in all the necessary data
and displays the results in the "Analyze Dataset" screen.
Using the File Type Analyzer utility 24
Analyzing data set results
Note: The File Type Analyzer utility uses the file extension to organize by tab the files in your
data set. However, the file extension is not a reliable means of detecting a file type because
the file extension can easily be changed. Symantec Data Loss Prevention detects file type
based on uniquely-identifying specific bytes.
When you analyze data set results, your goal is to locate the unique bytes that are consistent
for each instance of the file type. These unique bytes are the "magic bytes" for the analyzed
file type. You must determine what the magic bytes are to write a script that detects the custom
file type. For example, the first 2 bytes of a Microsoft Word file (*.doc) are DO CF (in
hexadecimal format).
To help you assess the results and find the magic bytes for the custom file type, click the
Analyze Table Data option. With the default option COLUMN_MATCH selected, the File Type
Analyzer utility highlights the columns that are the same across all files in the selected tab.
The ROW_OFFSET_MATCH option looks for byte matches within the same file (row). The
offsets (columns) that match in the same row are highlighted; those that match the same offset
in another row are not. This option is useful for a few file types that use unique bytes within
the same file to indicate file type. For example, the CADAM file type (*.cdd) uses the same
values for bytes 0 – 3 and bytes 8 – 11 within each file, but these values are different across
files.
Once you have analyzed the results and determined the magic bytes, the next step is to write
a script to detect the file type.
See “About the scripting language syntax” on page 8.
Refer to the tutorials for instructions on creating the data set, analyzing the results, and writing
a script to detect a custom file type. These tutorials demonstrate how the File Type Analyzer
utility works and should help you get started scripting solutions to detect custom file types.
See “Tutorial 1: Detecting Java class files” on page 29.
See “Tutorial 2: Detecting an encrypted ZIP file format” on page 32.
Using the File Type Analyzer utility 25
Testing the script solution
Table 3-2 Parameters for testing the script solution against the data set
Parameter Use
Solution This field is where you enter the script text you want to use to detect the custom file type.
Notes This field provides a mechanism for annotating the data set you have configured and your script
solution.
This field is useful for saving your data set configurations and script solutions.
Test Solution Click this option to verify that your script accurately detects the custom file type.
When you test your solution, the utility takes the data from the data set table and filters the
files based on the data set criteria. Once the data set is built, the script engine runs the solution
against the data set. Then it displays the results in the "Test Dataset Results" screen. The
displayed results give you an indication of how well your script has worked to detect the custom
file type.
The "Test Dataset Results" screen displays the results of the test in two tabbed panes:
■ Matched Files – The top pane lists all the files in the configured data set that your script
detected.
■ Mismatched Files – The bottom pane displays all the files in the configured data set that
your script did not detect.
This bifurcated display lets you quickly assess the accuracy of your script. You can easily see
files matched that should not (false positives). You can also see the files that failed to match
but should have (false negatives). Finally, you can see if there is any discrepancy between a
file extension and the actual file type based on its unique bytes.
Parameter Use
Save You can perform a File > Save action to save your data set configuration and script solution.
The file is saved as a *.fgi file type.
Open You can perform a File > Open action to open a saved data set. Browse to the *.fgi file and
open it.
Edit Dataset Use this option to change the configuration parameters of an active data set.
You can add directories to or remove directories from the data set, change configuration
parameters, or update the script solution.
3 The interface should launch with the Java heap size increased accordingly.
You should now be able to analyze or test a large or a recursive data set without error or
significant delay.
9 If the files you want to screen are in nested directories, choose the Recursive Scan
option.
Note: If you choose the Recursive Scan option, or you have a large data set, increase the
Java heap size allocated to the File Type Analyzer utility.
See “Increasing the Java heap size for large or recursive data sets” on page 26.
10 Click Analyze Dataset. The utility analyzes all files in the directory and displays the results.
The utility organizes each file by tabs according to its extension. In the All tab the utility
displays all screened files. In the .class tab the utility displays only the Java class files.
11 Click Analyze Table Data again. This time the utility highlights the bytes within each file
that match across all files.
As you can see, for Java class files there are several bytes in common, including the first
four (0 through 3): CA FE BA BE. These bytes are the magic bytes for Java class files.
In the drop-down menu at the bottom you can change how the utility analyzes table data.
The default option is COLUMN_MATCH, which generally provides the most accurate
matching. If you switch to this analysis mode you need to click Analyze Table Data again
to see the matching bytes by row.
12 Now that you know what the magic bytes are for Java class files, you can author a script
to detect this file type. You can then test your script using the File Type Analyzer utility.
In the Solution field, enter the following script to detect Java class files:
$Int1 = getHexStringValue('CAFE');
$Int2 = getBinaryValueAt($data, 0x0, 2);
assertTrue($Int1 == $Int2);
$Int3 = getHexStringValue('BABE');
$Int4 = getBinaryValueAt($data, 0x2, 2);
assertTrue($Int3 == $Int4);
13 Click Test Solution. At the top of the interface you see the Matched Files. Only those
files containing the CAFE BABE magic bytes appear in the "Matched Files" section of the
interface. Files that do not contain these magic bytes appear in the Mismatched Files
section at the lower-half of the interface.
Analysis of the script solution:
■ When you analyze the data set, the File Type Analyzer utility indicates that the first 2
bytes of a Java class file are CA FE. So, in the first statement of the script you assign
that value as a hexadecimal string to the variable $Int1.
Tutorials for custom file type identification 32
Tutorial 2: Detecting an encrypted ZIP file format
■ In the second statement of the script you get the firsts 2 bytes of each file and assign
that value to the variable $Int2. The "0x0, 2" portion of the statement tells the script
engine to start at the first byte and get the first two.
■ In the third statement you compare the values of the two variables and check for a
match.
■ The process is repeated for the third and the fourth bytes ("0x2, 2"), looking for a match
on BA BE. Files that match both evaluations are detectable by the script and appear
in the "Matched Files" portion of the interface.
14 In the Note section enter a comment about the solution, such as "Custom script for
detecting Java class files."
15 In the File Type Analyzer interface, select File > Save. Give the file a name and save it
to a local directory, such as C:\temp\JavaClassFiles.fgi.
16 Close the File Type Analyzer interface and relaunch it. Choose File > Open then browse
to and select the JavaClassFiles.fgi file.
The data set parameters and script solution appear in the interface. From here you can
reanalyze the data set and refine your solution as necessary. Click Edit Dataset to add
or remove directories containing files you want to analyze. You can also right-click a row
and remove an individual file from the data set.
17 Once you have debugged your solution, deploy your script to an instance of the Custom
File Type Signature rule. You can then author and deploy new policies that use this rule
to detect the custom file type.
Note: This script detects if a ZIP file is encrypted by checking if the encryption bit is enabled
on the first file entry. Because ZIP files can only be encrypted on a per-file basis, this script
only works if all files or the first file in the ZIP archive are encrypted.
$pktag=ascii('PK');
$frecord=getHexStringValue('0304');
$pkbytes=getBinaryValueAt($data, 0x0, 2);
assertTrue($pktag == $pkbytes);
$recordbytes=getBinaryValueAt($data, 0x2, 2);
assertTrue($frecord == $recordbytes);
$cryptByte=getBinaryValueAt($data, 0x6, 1);
$encrypted=mod($cryptByte, 2);
assertTrue($encrypted == 1);
9 The solution should match only those ZIP files in the data set that are encrypted. The ZIP
files that are not encrypted should appear in the "Mismatched Files" pane.
Analysis of this script solution:
■ $pktag=ascii('PK');
Tutorials for custom file type identification 34
Implementing custom script validators
The first statement assigns the "$pktag" variable the value "PK." If you switch the
Parser Type to ASCII, you see that the first 2 bytes of all ZIP files are "P" and "K".
■ $frecord=getHexStringValue('0304');
The second statement assigns the "$frecord" variable the value of "0304", which are
the third and fourth bytes of the ZIP files. (Switch back to BYTE for the Parser Type
to confirm this value.)
■ $pkbytes=getBinaryValueAt($data, 0x0, 2);
The third statement gets the binary value of the first 2 bytes.
■ assertTrue($pktag == $pkbytes);
The fourth statement compares the values of the "$pktag" and "$pkbytes" variables,
looking for an exact match of "P" and "K". If the values match, the assertTrue value is
achieved.
■ $recordbytes=getBinaryValueAt($data, 0x2, 2);
The fifth statement checks the binary value of the third and fourth bytes (start at the
third byte and count 2). Here the values (in BYTE mode) are "03" and "04".
■ assertTrue($frecord == $recordbytes);
The sixth statement compares the values of the "$frecord" and the "$recordbytes"
variables. If the returned value ("$recordbytes") matches the value assigned to the
"$frecord" variable ("03" and "04"), the assertTrue value is achieved.
■ $cryptByte=getBinaryValueAt($data, 0x6, 1);
The seventh statement gets the binary value at the seventh byte (column 6).
■ $encrypted=mod($cryptByte, 2);
The eighth statement divides the value of the seventh byte (as assigned to the
"$cryptByte" variable) by "2." It then assigns this remainder to the "$encrypted" variable.
■ assertTrue($encrypted == 1);
The ninth statement checks the value of the "$encrypted" variable. If the value is zero
(no remainder), then the ZIP file is not encrypted. If there is a remainder then the ZIP
file is encrypted.
Note: Refer to the Symantec Data Loss Prevention Administration Guide, or to the online Help
documentation, for details on implementing custom data identifiers.
Index
C
custom file type detection
workflow 28
custom script validators
workflow 34
F
file type analyzer
about 20
analyzing results 24
column match 24
dataset creation 22
editing 25
increase Java heap size 26
increase number of bytes analyzed 26
install 21
launching 22
opening 25
row offset match 24
saving 25
testing script solutions 25
S
scripting language
about 7
assert statement 9
encrypted ZIP files 32
evaluate statement 11
evaluate statement functions 12
example custom file type scripts 15
example custom validator scripts 17
if/else statements 10
Java class files 29
syntax 8
system variables 9