Malicious file upload

If your application allows file uploads, attackers could upload malicious files that compromise your system. Application Security leverages Trend Micro Smart Scan as well as the Advanced Threat Scanning Engine (ATSE) to protect your application from malicious file uploads by scanning uploaded files for malware and restricting the size of uploaded files.

Malicious file upload uses FQDN:"https://dsap1.icrc.trendmicro.com/".

Configure the malicious file upload policy

1. Select the group.
2. In the left pane, click .
3. Ensure that Malicious Upload is enabled.
4. Set the state to Report. This will trigger events without blocking the request, which allows you to run your application and see which expected behaviors trigger malicious file upload events.
5. On the right of the page, click .

6. Configure the following settings to protect against malicious file upload attacks:

   • Antivirus Scanning: Scans uploads for malware
     • Max Buffer (MB): The maximum amount of memory to be allocated for buffering.
     • Archive compression level limit: The maximum compression level the scanner will go through in archives.
     • Archive file count limit: The maximum number of files the scanner will scan in archives.
     • Archive file size limit:The maximum archive size the scanner will scan. A value of 0 disables archive malware scanning.
     • ATSE Scan Aggressiveness Level: The aggressiveness level when the Advanced Threat Scan Engine (ATSE) engine scans files with heuristics. The default value is Medium, with the possible values of Low, Medium, High and Very High. Very High might generate false positive. Please refer to the table for agents versions compatibility for this feature.
   • File Size Check: Restricts the size of uploaded files.
     • Max Filesize (MB): The maximum file upload size permitted. A value of 0 disables file uploads.

7. Select Save Changes and close the window.

8. Navigate to your application and upload a typical file. Use the application in the various scenarios that it was designed to handle.
9. On the Dashboard, check the Events page for Malicious File Upload events (see Manage events for more information). If one has been triggered, follow the steps in Manage malicious file upload events.
10. Once you're happy with your policy configuration and events are no longer being triggered by expected behavior, go to Your Group > Policies > Malicious File Upload.
11. On the right of Malicious File Upload, set the state to Mitigate. When a rule is triggered, the attempt will be blocked and a Malicious File Upload event will appear on the Dashboard.

Agents' versions compatibility with ATSE aggressiveness feature setting

For all other agents or agents versions, the ATSE aggressiveness setting has no effect, and the default value of Very High is used by these agents.

Malicious file upload events

Malicious file upload events are displayed on the Dashboard in Events or in your respective groups's dashboard.

Every event includes the Request Details panel for general information about the event. For more information, see Manage events.

Under Antivirus Scanning the following information specific to the malicious file upload policy is displayed, depending on what triggered the event:

Trigger: Antivirus Scanning

• Virus name
• File name
• Parameter

• ATSE Aggressiveness Level

  

Trigger: Size Check

• Entity size

  

Manage malicious file upload events

If Application Security is reporting malicious file upload events:

Select Click to Manage Policy. In the Alert section, you can see what policy rule was triggered. If you'd like to allow this behavior on your application, reconfigure the rule based on your desired parameters.

For example, if a malicious file upload event was triggered because a file was five MB larger than the max file size, increase the max file size by five to allow these files to be uploaded in the future.