Friday, May 19, 2017

File Extensions to Block at Email Gateway

I've combined my file extension block list for email gateways with @HackerHurricane's from his Slideshare here, @cyb3rops list from his ransomware prevention document here, and Microsoft's list from here. Let me know if you have more to add.

.386, .ace, .acm, .acv, .ade, .adp, .adt, .ani, .app, .arc, .arj, .asd, .asp, .asx, .avb, .ax, .bas, .bat, .bin, .boo, .btm, .cab, .cbt, .cdr, .cer, .chm, .cla, .cmd, .cnt, .cnv, .com, .cpl, .crt, .csc, .csh, .css, .der, .dll, .drv, .dvb, .email, .exe, .fon, .fxp, .gadget, .gms, .grp, .gvb, .hlp, .hpj, .ht, .HTA, .htlp, .htt, .inf, .ini, .ins, .iso, .isp, .its, .jar, .jnlp, .job, .js, .jse, .ksh, .lib, .lnk, .mad, .maf, .mag, .mam, .maq, .mar, .mas, .mat, .mau, .mav, .maw, .mcf, .mch, .mda, .mdb, .mde, .mdt, .mdw, .mdz, .mht, .mhtm, .mhtml, .mpd, .mpt, .msc, .msh, .msh1, .msh1xml, .msh2, .msh2xml, .mshxml, .MSI, .mso, .msp, .mst, .nws, .obd, .obj, .obt, .obz, .ocx, .ops, .osd, .ovl, .ovr, .pcd, .pci, .perl, .pgm, .pif, .pl, .plg, .pot, .prf, .prg, .ps1, .ps1xml, .ps2, .ps2xml, .psc1, .psc2, .pst, .pub, .pwz, .qpw, .reg, .sbf, .scf, .scr, .sct, .sfx, .sh, .shb, .shs, .shtml, .shw, .smm, .svg, .sys, .td0, .tlb, .tmp, .torrent, .tsk, .tsp, .tt6, .url, .vb, .vbe, .vbp, .vbs, .vbscript, .vbx, .vom, .vsd, .vsmacro, .vsmacros, .vss, .vst, .vsw, .vwp, .vxd, .vxe, .wbk, .wbt, .wiz, .wk, .wml, .wms, .wpc, .wpd, .ws, .wsc, .wsf, .wsh, .xbap, .xll, .xnk

2 comments:

Anonymous said...

Since Win10 will mount .img files as easy as double-clicking on them, I'd recommend adding it to the list.

GROUND Security said...

You should consider adding VHD/VHDX to this list as well, due to some recent revelations with them:
https://blog.knowbe4.com/cyberheistnews-vol-9-42-heads-up-virtual-hard-disk-images-containing-malware-are-ignored-by-antivirus-and-windows