Introduction

This Silo feature scans files for malware before downloading them to a user’s device. Files saved to Silo’s Cloud Storage will not be scanned. If a user is allowed to download a malicious file by policy, it will be delivered in a zip archive.


Steps


1. Open Silo Drive from the browser toolbar menu and select the file you would like to download to your local computer.



2. The “Save File As” window opens, click the Save button. The malware scan begins.




Once you click on Save our malware scanner will run in the background to check for potential threats. If the threat is detected. you will be notified with popup windows on the bottom right corner.


    


If you do not have permission to download a malicious file, this warning appears.



However, if your administrator enables the ‘notify but allow download of malicious file’ permission, the following warning appears.



3. At this point, you may click the Cancel button to stop the download, or, click the Download ANYWAY button to accept the risk.



Example of the malicious file download.




Technical Details

To set the Malware Scanning policy, open the Admin Console panel and click on Manage under Policies.



Click the drop-down menu under Data Transfer and Edit Malware Scanning.


This is the default setting.

This is how to disable Malware Scanning.


This is how to enable ‘notify but allow download of malicious files.


Exploit Audit Log*

AppServer generated audit logs - AppServer generates logs when an exploit is discovered while downloading a file to the local computer. The delivered value will change based on if the user decides to download the malware. *This section is part of the Silo Logs Reference Guide. For additional information, refer to Silo Logs Reference Guide. 


{ "origin": "unknown"*,

"delivered": true,

"client_ip": "client ip",

"user_id": "UserId",

"seq_id": 4418356,

"filetype": "CL_TYPE_TEXT_ASCII",

"org_id": "OrgID",

"exploit_name": "Eicar-Test-Signature",

"session_id": "Session ID",

"filename": "eicar.com test",

"username": "username",

"create_ts": "2018-04-12 17:55:19",

"type": "EXPLOIT"

}


Note: If “delivered”: true then *malicious file delivered as a zip archive.


*origin not used at this time.


Avoid Malware Scanning

If you are using the File Management API Reference Guide, these changes are mandatory when virus scanning is on.


        1. This is an example of using cURL without the new skip exploit scan flag:


         2. Here are examples with new flags (skip-exploit-scan & deliver-exploit):


Notice the only difference is the new skip-exploit-scan=y at the beginning of POST Body... the text after -d


Workflows


        1. Deliver exploit is used in the "workflow for downloading malware" (new)

  • Request file
  • Response says file is infected
  • Re-request file with deliver-exploit flag
  • Response will be zipped version of file

    

        2. Skip exploit scan is used in this workflow


Note: Malware scan policy must be off or on and allow download


  • Request file with skip exploit
  • Response is original unzipped file, no malware scan


Additional Notes  

Please contact Support if you have any additional questions and/or require further information.