Well Known Extension List

Introduction

The crowd-sourced extension list is built from Defender deployments worldwide. When custom extensions are added to local deployments, the system collects them and merges them into a list curated by Superna, which is then published as a version of the master list.

The versioned list will continue to function, now including extensions sourced through the crowdsourcing system. By adding custom extensions to your Defender installation and enabling the phone home feature, you can contribute your custom extensions for Superna's review and potential inclusion in the master list.

Pre-Requisites

The Eyeglass VM needs firewall rules to allow access to the following URL: Superna Storage URL

How to Check the Settings

To check your settings, run the command: igls rsw filefiltersettings

• If the "mode" is set to "Latest," it means the auto-update is enabled, Data Security will always use the latest version available online.

• If the "mode" is set to "Fixed," it means a static version of the list is used, and you can choose which version to switch to.

Running this command will also display the list of available versions.

Example of Return:

admin@superna:~> igls rsw filefiltersettings

{
    "currentSettings": {
        "mode": "Fixed",
        "currentVersion": "base"
    },
    "availableVersions": [
        "20201207",
        "20210405",
        "20211018",
        "20220118",
        "20220228",
        "20220413",
        "20220509",
        "20220606",
        "20220704",
        "20220808",
        "20220920",
        "20221012",
        "20221107",
        "20221212",
        "20230724",
        "20230826",
        "20240123",
        "20240527",
        "20240807"
    ]
}

How to Update the List

Updating the List When Auto-Update Is Disabled (“Mode” = “Fixed”)

1. Review the List of New Extensions

   Ensure they align with your organization's needs, as adding them may trigger new alerts and result in user lockouts. Use the following command:

   • igls rsw filefiltersettings --diff=<version1,version2>
   note

   version2 should be the latest published version.

   
   

   The output shows extensions added and removed when moving from version1 to version2.

2. Switch Eyeglass to the New Version of the List and Edit It According to Your Organization's Needs

   Use the command:

   • igls rsw filefiltersettings set --mode=Fixed --version=<version>

   Once updated, the file extensions appear in the File Filter tab in the Ransomware Defender interface. You can then manage the list. The extensions you added manually are not affected.

Updating the List When Auto-Update Is Enabled (“Mode” = “Latest”)

1. When auto-update is enabled, the new version replaces the previous one.

2. Review the List of New Extensions

   Ensure they align with your organization's needs, as adding them may trigger new alerts and result in user lockouts. Use the following command:

   • igls rsw filefiltersettings --diff=<version1,version2>
   note

   version2 should be the latest published version.

   
   

   The output shows extensions added and removed when moving from version1 to version2.

3. Once updated, the file extensions appear in the File Filter tab in the Ransomware Defender interface. You can then manage the list. The extensions you added manually are not affected.

Other Options for Managing the File Extension List

• Enable Auto-Update

  You can enable the auto-update option. Eyeglass Data Security checks for new versions and automatically switches to the latest one. Use the command:

  • igls rsw filefiltersettings set --mode=Latest

• Roll Back to an Older Version

  If you prefer to revert to an older version of the list, use the command:

  • igls rsw filefiltersettings --version=<version>

List in 2.5.8 or Greater

The versioned banned list feature allows you to switch between the current banned file list and newly published versions. You can also select the option to always use the latest file. Be cautious: if the new list includes extensions used in your environment, it could cause a lockout. This feature lets you control the switch to a new file and see which new extensions have been added.

note

This feature does not support OS Proxy with YAST.

Versioned Banned Files List

The versioned banned files list feature lets you select and compare different versions of the banned file list. It also allows automatic selection of the latest version. This helps you migrate from one version to another using the commands below. The files appear in the File Filter tab in the Ransomware Defender GUI.

Requirements

• Requires version 2.5.8 or Greater.

Versioned Files and New Extensions

This section lists the versioned files and includes links to files containing the new extensions added in each version.

File Version Commands

• igls rsw filefiltersettings — Lists the current version and settings.
• igls rsw filefiltersettings --version=<version> — Selects a specific version.
• igls rsw filefiltersettings --diff=<version1>,<version2> — Shows the changes between two versions, including new file extensions added.
• igls rsw filefiltersettings set --mode=Latest — Uses the latest version available online.
• igls rsw filefiltersettings set --mode=Fixed --version=<version> — Sets a fixed version as the banned list to use.

See Also