I have a UniFi Security Gateway (USG Pro 4P) and just enabled IPS (intrusion prevention system). I am seeing many "ET POLICY PE EXE or DLL Windows file download HTTP" alerts. I have not been able to find any more information on that alert. Should I worry about this alerts or white list it? The destinations are all over the world so I am concerned

This is a list of some of the worldwide destinations

This is the specific alert through the ui


The "ET POLICY" part of the alert is telling you that it's a 'Policy' rule: i.e. it's not an attack per se, it's just something which might violate a corporate policy.

That particular alert is just telling you that someone has downloaded a Windows executable file or DLL over HTTP. In most cases this is just noise, unless you've prohibited downloading of executable files in your environment.

| improve this answer | |


You should contact your provider of your appliance and inform them about the case. On the other hand, you could try to capture (Wireshark, tcpdump, etc) some of the traffic that is generating the issue and try to analyze probably with your appliance provider or by your self. Could be a false positive or your systems or could be under an attack or infected.

| improve this answer | |

That is normal to be seen if you have configured .exe filtering. The alert just informs you that it has been a blocked attempt to retrieve an .exe and that is not allowed by the policy.

The actual problem seems to be that the same IP is trying to get the .exes. So if there's an user there that wants to download something, then just go tell him that what he wants is not allowed. If the system acts by itself, it may be infected with something trying to connect to a download site to further infect your system.

Additional note: the IPs on the list do not appear to be on any C&C blacklists from what I quickly checked.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.