Skip to main content

Join us at Gartner SEC London and discover how LevelBlue can help you secure what’s next. Learn More

Loading...
Loading...

PRB: Microsoft IRM Protected Documents not recognized as encrypted

Expand / Collapse


This article applies to:

  • MailMarshal (SEG) 6.4

Question:

  • Microsoft IRM Protected Documents not recognized as encrypted

Resolution:

To resolve this issue, upgrade to the latest version of MailMarshal SMTP. This issue was first resolved in version 6.5.

Workaround:

With MailMarshal SMTP 6.4, the following signatures can be used to identify IRM protected documents.   

-Microsoft Word 1997-2003

T: IRMDOC
D: Microsoft IRM Documents
X: 2202=44 00 52 00 4d 00 43 00 6f 00 6e 00 74 00 65 00 6e 00 74

-Microsoft Office 2007 IRM Docs

T: IRM2K7
D: Microsoft Office 2007 IRM Docs
X: 2236=44 00 52 00 4d 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64

NOTE: Files that are identified as a custom file type will not be unpacked for analysis by the MailMarshal Engine.

When you upgrade, you must remove these custom filetypes in order to use the updated functionality.

Notes:

See the following LevelBlue Knowledgebase article for more information:

  • Q10199 : How do I add custom file type definitions to MailMarshal?

To contact LevelBlue about this article or to request support:


Rate this Article:
     
Tags:

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.