Custom signature for streaming audio

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 194445

Article

Description Blocking Windows streaming audio using custom IPS signatures.

Components

FortiOS 2.8 and 3.0.

Steps or Commands

Use the following custom IPS signature to block the use of streaming audio in Microsoft Windows.

To add a custom signature

Go to Intrusion Protection> Signature> Custom.
Select Create New.
Enter the name for the signature, for example, "Windows Streaming Audio".
For the Signature, enter the following:
F-SBID( --name "Block.WMP.Get"; --default_action drop_session; --protocol tcp; --service HTTP; --flow from_client; --pattern "Pragma: xPlayStrm=1"; )
Set the Action to Drop Session.
Select OK.

Note: In FortiOS 3.0 MR6, you create the custom signature, then add it to an IPS sensor where you define the action.

1260

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.