Scanning password-protected attachments

This section includes:

• Scanning password-protected attachments
  • About scanning password-protected attachments
  • Searching for emails with password-protected attachments

About scanning password-protected attachments

Some emails include attachments that are password-protected. The password-protection makes scanning of these attachments more complex.

When Perception Point X‑Ray receives an email with an attached file that is password-protected, Perception Point X‑Ray will try various procedures to open the file:

• Perception Point X‑Ray will first try to locate the password in the email content.

• If the password isn't found in the email content, Perception Point X‑Ray will try to open the attachment using a database of common passwords.

If Perception Point X‑Ray is able to open the password-protected file, Perception Point X‑Ray will scan the file, and then handle the file according to the scan verdict.

What happens if Perception Point X‑Ray isn't able to open the password-protected file?

Default behavior

By default, if Perception Point X‑Ray isn't able to open the password-protected file, the file will be considered to be clean. If no other malicious evidence is detected in the email, the verdict of the email scan will be set to clean, and the email will be sent to the target recipient.

Customized behavior

Perception Point X‑Ray can be configured so that when a password-protected file is attached to an email, and Perception Point X‑Ray isn't able to open the file, then the file will not automatically assumed to be clean. In stead, the parent email will be assigned a restricted verdict and quarantined. Perception Point X‑Ray will then send an email to the original target [recipient] of the email, requesting the recipient to provide the password for the password-protected file. A screenshot of the original email is included in the email - to help the recipient identify the password-protected file. The password-protected file [and the parent email] will be kept in quarantine until a valid password is supplied. When a valid password is supplied, Perception Point X‑Ray will scan the file and then handle the file and email according to the scan verdict. Contact Perception Point Support [support@perception-point.io] for assistance in implementing this feature. You can include the text template below in your email to Perception Point Support: Subject: Configuration: Requesting passwords for password-protected files Auto-email Hi Perception Point Support Team, Organization name: <Your org name> Please can you configure the system to request passwords to enable scanning of password-protected files. [Internal Reference: 1149] Please let us know when this has been done. Thank you Note: The customized operation can be applied to all protected email addresses in an organization, or to only specified email addresses. Contact Perception Point Support for implementation details. Limitation: If an email has more than one password-protected attachment, only one attachment will be scanned. If that attachment is found to be clean, the email will be released with a clean verdict - the remaining password-protected attachments won't be scanned.

Searching for emails with password-protected attachments

You can display a list of the scanned emails that have password-protected attachments.

To display a list of the scanned emails that have password-protected attachments:

1. In the Scans page, open the Advanced filters feature. For details, see Advanced filters.

2. Scroll down the list of filter options, and then under Files > Password Protected, select Protected.

   

   Note: If you don't see the Files > Password Protected > Protected check box, contact Perception Point Support [support@perception-point.io] and ask them to enable this functionality for you.

3. Click "Apply Filters" to display a list of emails that have password-protected attachments.

See also: 

• Scans