LevelBlue Completes Acquisition of Trustwave to Form the World's Largest Pure-Play MSSP.  Learn More

LevelBlue Completes Acquisition of Trustwave to Form the World's Largest Pure-Play MSSP.  Learn More

Services
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

Database Security

Prevent unauthorized access and exceed compliance requirements.

Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

View All Trustwave Services
Solutions
BY INDUSTRY
BY REGULATION
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft Security
Unlock the full power of Microsoft Security
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
We reduce cyber risk and fortify organizations
Awards and Accolades
Recognition by analysts and media outlets
Trustwave SpiderLabs Team
Global researchers, ethical hackers, and responders
Trustwave Fusion Security Operations Platform
Unprecedented security visibility and control
Trustwave Security Colony
Access to cybersecurity threat protection resources
Partners
Microsoft Security
Unlock the full power of Microsoft Security
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats
Register
Login
Resources
BLOGS
UPCOMING
MEDIA & ASSETS
NOTICES
HELP
Loading...
Loading...

Trustwave Knowledge Base

Home » Knowledgebase » WebMarshal » INFO: What file types are recognized by WebMarshal 7.X?

INFO: What file types are recognized by WebMarshal 7.X?

Expand / Collapse
Show/Hide Article Tools


This article applies to:

  • Trustwave WebMarshal 7.X

Question:

  • What file types are recognized by WebMarshal 7.X?

Information:

The following formats are recognized by WebMarshal 7.X.

Notes:

  • Some types are recognized only with specific updates to the File Type DLL, as noted.
    • WebMarshal 7.0 through 7.3 uses FileType 8.2.1
    • WebMarshal 7.4 uses FileType 8.2.6 (updated 8 November 2021).
    • WebMarshal 7.5 uses FileType 2023-03-01.
    • WebMarshal 7.6 uses FileType 2025-02-01.
In the tables below, Type Name refers to the name seen in the Engine log, Traffic Logs, and rule listings. Description is the name as seen when selecting types in the policy editor.
  • The Type Name is often the same as the usual file extension. However, file type detection is based on file structure and NOT on the file extension. If you rename a zip archive as ".TXT", it is still recognized as a zip archive by WebMarshal.

Archive

Type Name Description
7Z 7Zip Archive 
7Zcrypt 7Zip encrypted archive (from FileType 8.2.1)
7Zsfx 7Zip self extracting archive
ACE ACE archive
ACEsfx ACE self extracting archive
IWA Apple iWork Archive .IWA 
ARC ARC archive
ARJ ARJ archive
ARJcrypt ARJ encrypted archive
ARJsfxcrypt ARJ encrypted self extracting archive
ARJsfx ARJ self extracting archive
B64 Base64 (MIME) Encoding
B2A BtoA Encoding
BZ2 bZIP2 archive
CABI InstallShield CAB Archive
CPIO CPIO archive
DEB Debian Binary Package file 
GZ GZIP archive
HQX HQX (BinHex) archive
CABI InstallShield CAB Archive
CDISO ISO 9660 CD Filesystem
LYMESFX LYME self extracting archive  
LZH LZH archive
MacBIN MacBinary I, II, or III archive
MDXMedia MDX Extended Media Descriptor File 
CABM Microsoft CAB/Expand Archive
SZDD Microsoft SZDD archive 
MAR Mozilla Archive
MSI MSI Windows Installer package
MSIX MSIX Windows Installer Package (from FileType 8.2.1)
PBIX  Power BI Report (FileType 2025-02-01 and above)
RAR RAR archive
RARcrypt RAR encrypted archive
RARsfxcrypt RAR encrypted self extracting archive
RARsfx RAR self extracting archive
RARSpan RAR spanned archive
RPM Redhat Package Manager file 
SEAEncrypt SEA encrypted self extracting archive
SEA SEA self extracting archive
SIT SIT archive
SITEncrypt SIT encrypted archive
TAR TAR archive
UDF Universal Disk Format (UDF) (from FileType 8.2.3)
UUE UUencoded Encoding
XZ XZ archive (from FileType 8.2.1)
Z Z (compress) archive
ZIP ZIP archive
ZIPcrypt ZIP encrypted archive
ZIPsfxcrypt ZIP encrypted self extracting archive
ZIPsfx ZIP self extracting archive
ZOO ZOO archive

Azure IRM Protected Documents

New category and new items from FileType 8.2.1.
    Type Name Description
    RPMSGPLAIN Decrypted restricted-permission message 
    XLSXIRM Excel 2007+ document with IRM
    XLSIRM Excel document with IRM
    PFILE File protected with IRM 
    OREIRM OLE compound document with IRM
    XLSIRMcrypt Password protected Excel with IRM
    PPSIRMcrypt Password protected Powerpoint show with IRM
    PPTIRMcrypt Password protected Powerpoint with IRM
    WordIRMcrypt Password protected Word with IRM
    PPTXIRM Powerpoint 2007+ document with IRM
    PPTIRM Powerpoint document with IRM
    PPSIRM Powerpoint show with IRM 
    RPMSG Restricted-permission message 
    DOCIRM Word 2007+ doc with IRM in Word 2003 mode 
    DOCXIRM Word 2007+ document with IRM

    Document

    Type Name Description
    MDB Access database
    MDW Access system database
    INDD Adobe InDesign Document
    MSO Document data
    DVI DVI TeX document
    XLScrypt Encrypted Excel document 
    PPTcrypt Encrypted PowerPoint Document (from FileType 8.2.1)
    PPScrypt Encrypted PowerPoint Show (from FileType 8.2.1)
    DOCcrypt Encrypted Word document
    XLSB Excel 2007+ Binary Document 
    Includes later versions; see note below.
    XLSX Excel 2007+ document 
    XLSXIRM Excel 2007+ document with IRM 
    XLS Excel document
    XLSIRM Excel document with IRM 
    NFO Folio Infobase
    FM3 Lotus 123 FM3 sheet form
    WK1 Lotus 123 WK1 sheet
    WK3 Lotus 123 WK3 sheet
    WK4 Lotus 123 WK4
    SAM Lotus AmiPro document
    LWP Lotus WordPro document
    MCW Mac Word document
    ACCDB Microsoft Access Database .ACCDB
    ONE Microsoft OneNote
    VSDX Microsoft Visio 2013 Drawing
    DOCXML Microsoft Word 2003 XML Document
    OfficeMacroScript Office Macro Script
    Office2007Macro Office 2007+ Macro 
    Includes later versions; see note below.
    OLE OLE compound document
    OREIRM OLE compound document with IRM
    ODC Open Office chart file 
    OTC Open Office chart template 
    ODB Open Office database file 
    ODT Open Office document file 
    OTT Open Office document template
    ODF Open Office formulae file 
    OOoOTF Open Office formulae template 
    ODM Open Office global text document 
    OTH Open Office global text template 
    ODG Open Office graphics file 
    OTG Open Office graphics template 
    ODI Open Office image file
    OTI Open Office image template 
    ODP Open Office presentation file 
    OTP Open Office presentation template 
    ODS Open Office spreadsheet file 
    OTS Open Office spreadsheet template 
    OpenXML OpenXML Document (SEG 7.2.3 and above)
    PM6 PageMaker document
    XLSIRMcrypt Password protected Excel with IRM (from FileType 8.2.1)
    PPSIRMcrypt Password protected Powerpoint Show with IRM (from FileType 8.2.1)
    PPTIRMcrypt Password protected Powerpoint with IRM (from FileType 8.2.1)
    WordIRMcrypt Password protected Word with IRM (from FileType 8.2.1)
    PDF PDF document
    PDFXFAForm PDF document - Dynamic XFA form 
    PDFcrypt PDF document - Encrypted
    PDFInvalid PDF document - Invalid header record (see note below)
    PDFprotect PDF document - Protected
    PDFInvalidFormat PDF Un-recognized file format
    PS PostScript document
    PPTX PowerPoint 2007+ document 
    Includes later versions; see note below.
    PPTXIRM PowerPoint 2007+ document with IRM 
    PPTIRM PowerPoint document with IRM 
    PPSX PowerPoint 2007+ show 
    PPT PowerPoint document
    PPS PowerPoint show
    PPSIRM PowerPoint show with IRM 
    PRJ Project document
    PUB Publisher document
    QXD Quark Express document
    RTF Rich Text document
    Word2 Word 2 Document
    DOCIRM Word 2007+ doc with IRM in Word 2003 mode 
    DOCX Word 2007+ Document 
    Includes later versions; see note below.
    DOCXIRM Word 2007+ document with IRM 
    DOC6 Word 6 Document
    DOC Word document
    WPD WordPerfect document
    WPS Works for Windows document
    WRI Write document
    XPS XPS Document 

    Drawing

    Type Name Description
    AI Adobe Illustrator drawing
    DWG AutoCAD Drawing
    DWF AutoCAD Format
    CTB AutoCAD Plotting Support .CTB 
    CMX Corel Binary Meta file
    CDR Corel Draw Drawing
    DXF Drawing Interchange File DXF
    FP3 FloorPlan Plus 3D
    FH Freehand drawing
    VSDX Microsoft Visio 2013 Drawing .VSDX 
    VXD Microsoft Visio Drawing
    NWD Navisworks Document .NWD (from FileType 8.2.7)
    Solidworks Solidworks CAD files (.SPDPRT, .SLDASM, .SLDDRW, .SLDDRT) (from FileType 8.2.5)
    STL StereoLithography Drawing

    Encrypted

    Type Name Description
    7Zcrypt 7Zip encrypted archive (from FileType 8.2.1)
    ARJcrypt ARJ encrypted archive
    ARJsfxcrypt ARJ encrypted self extracting archive
    AXCRYPT AXCrypt Encrypted Data
    Switch Egress Switch Encrypted Mail 
    XLScrypt Encrypted Excel document 
    PPTcrypt Encrypted PowerPoint Document (from FileType 8.2.1)
    PPScrypt Encrypted PowerPoint Show (from FileType 8.2.1)
    DOCcrypt Encrypted Word Document
    XLSXIRM Excel 2007+ document with IRM 
    XLSIRM Excel document with IRM 
    PFILE File protected with IRM 
    GPG Gnu Privacy Guard file .GPG (from FileType 8.2.5)
    OREIRM OLE compound document with IRM
    XLSIRMcrypt Password protected Excel with IRM (from FileType 8.2.1)
    PPSIRMcrypt Password protected Powerpoint show with IRM (from FileType 8.2.1)
    PPTIRMcrypt Password protected Powerpoint with IRM (from FileType 8.2.1)
    WordIRMcrypt Password protected Word with IRM (from FileType 8.2.1)
    PDFcrypt PDF document - encrypted
    PENC Perl Encoded file .ENC (from FileType 8.2.5)
    PGP PGP Encrypted Data
    PPTXIRM Powerpoint 2007+ document with IRM
    PPTIRM Powerpoint  document with IRM
    RARcrypt RAR encrypted archive
    RARsfxcrypt RAR encrypted self extracting archive
    RPMSG Restricted-permission message  
    SEAEncrypt SEA encrypted self extracting archive
    SITEncrypt SIT encrypted archive
    P7M SMime Encrypted Data
    DOCIRM Word 2007+ document with IRM in Word 2003 mode
    DOCXIRM Word 2007+ document with IRM 
    ZIPcrypt ZIP encrypted archive
    ZIPsfxcrypt ZIP encrypted self extracting archive
    ZIX ZixCorp encrypted mail

    Executable

    Type Name Description
    7Zsfx 7Zip self extracting archive 
    ACEsfx ACE self extracting archive
    ARJsfxcrypt ARJ encrypted self extracting archive
    ARJsfx ARJ self extracting archive
    CLASS Java class file
    APPL Macintosh M68k executable
    PEF Macintosh PPC executable
    CABM Microsoft CAB/Expand Archive
    COM MSDOS Com executable
    EXE MS-DOS Executable
    MSI MSI Windows Installer Package
    MSIX MSIX Windows Installer Package (from FileType 8.2.1)
    NLM NetWare Loadable Module
    EXEO16 OS/2 16bit executable
    DLLO32 OS/2 32bit DLL
    EXEO32 OS/2 32bit Executable
    PYC Python bytecode file (from FileType 8.2.1)
    RARsfxcrypt RAR encrypted self extracting archive
    RARsfx RAR self extracting archive
    SEAEncrypt SEA encrypted self extracting archive
    SEA SEA self extracting archive
    CIF UNIX CIF Executable
    COFF UNIX COFF Executable
    ELF UNIX ELF Executable
    DLLW16 Win16 DLL
    EXEW16 Win16 executable
    DLLO16 Win16 VXD or OS/2 DLL
    DLLW32 Win32 DLL
    EXE32W Win32 executable
    ZIPsfxcrypt ZIP encrypted self extracting archive
    ZIPsfx ZIP self extracting archive

    Font

    Type Name Description
    EOT Embedded OpenType Font
    OTF OpenType Font
    TTF True Type Font
    AFM Type 1 Adobe Font Metric
    PFB Type 1 Printer Font Binary
    PFM Type 1 Printer Font Metric
    WOFF Web Open Font Format 
    FON Windows Bitmap font
    ODTTF XPS Embedded font (ODTTF) 

    Image

    Type Name Description
    PSD Adobe Photoshop Image
    BMP Bitmap image
    CPT Corel Photo-Draw Image
    EPS Encapsulated PostScript
    EMF Enhanced MetaFile Image
    GIF Gif image
    HEIC HEIF image (from FileType 8.2.4)
    ICO Icon
    JPG Jpeg image
    JBIG2 JBIG2 image
    JPEG2000 Jpeg2000 image
    CIL Microsoft ClipArt Gallery
    MDI Microsoft Document Image
    MIX Microsoft PhotoDraw Image
    PSP Paint Shop Pro image
    PNG Portable Network Graphics (PNG)
    SVG Scalable Vector Graphics (FileType 2025-02-01 and above)
    TIF Tiff image
    WEBP WebP Image File (from FileType 8.2.1)
    HDPHOTO Windows HD Photo 
    WMF Windows MetaFile Image
    PCX Zsoft PCX Image

    Mail Components

    Type Name Description
    MBODY Mail Body
    MHDR Mail Headers
    MAIL Mail message
    TNEF TNEF Exchange Mail Message
    HTMLBody TNEF Exchange Mail Message extracted HTML Mail Body
    RTFBody TNEF Exchange Mail Message extracted RTF Mail Body

    Other

    Type Name Description
    BPlist Apple Binary Plist
    AppleDouble AppleDouble header
    AppleSingle AppleSingle formatted file
    BIN Binary Unknown (indicates a file of unrecognized type)
    TORRENT Bittorent .torrent metainfo file 
    ICS Calendar Meeting Invitation (iCalendar) 
    ICSDescription Calendar Meeting Invitation Description 
    ICSSummary Calendar Meeting Invitation Summary 
    TPS Clarion TopSpeed File .TPS
    CHM Compiled HTML Help file
    DBF dBase/xbase Data File .DBF
    DBT dBase Memo Field File 
    MDXdbase dBase Multiple Index File 
    SYS DOS device driver 
    VCF Electronic Business Card .VCF 
    ICM Independent Color Matching .ICM
    InfoSlip Infoslips document 
    JOS Java Object Serialized Data 
    DSStore Mac OSX Finder Info 
    MAPIBlock MAPI Encoded data
    OST MAPI Off-line Store
    PAB MAPI Personal Address Book
    PST MAPI Personal Store
    MAT MATLAB Data File (from FileType 8.2.1)
    PDB Microsoft Debugging Symbols 
    LIB Microsoft Program Library 
    MSBLDCACHE MS Build Cache File 
    RCM MTXWIN95 Registry Command File
    OracleRDF Oracle Report Definition File 
    Appointment Outlook Appointment
    Contact Outlook Contact
    MSG Outlook message
    Note Outlook Note
    Task Outlook Task
    P12 PKCS#12 Certificate Archive (FileType 2023-03-01 and above)
    PCAP Packet Capture 
    PCAPNG Packet Capture NG 
    PEMCert PEM encoded certificate .PEM (from FileType 8.2.1)
    PFX PFX Certificate Archive (FileType 2023-03-01 and above)
    PGPPublicKey PGP Public Key (.ASC) (FileType 2025-02-01 and above)
    PGPSigned PGP Signed Data 
    PBIXMashup Power BI Data Mashup Archive (FileType 2025-02-01 and above)
    PBIXMetadata Power BI Data Metadata (FileType 2025-02-01 and above)
    PBIXModel Power BI Data Model (FileType 2025-02-01 and above)
    PBIXBindings Power BI Security Bindings (FileType 2025-02-01 and above) (Current SEG)
    PBIXSettings Power BI Settings (FileType 2025-02-01 and above)
    QBB QuickBooks Backup .QBB 
    QBW QuickBooks Company file .QBW (from FileType 8.2.1)
    RTF Object RTF Object
    SHP Shape file .SHP (from FileType 8.2.1)
    SHX Shape Index file .SHX (from FileType 8.2.1)
    P7S SMime Signed Data
    SQLiteDB SQLite Database
    EMC Striata Encrypted Mail Communication 
    TEXT Text
    VHD Virtual Hard Disk Image .VHD (FileType 2023-03-01 and above)
    VSSSCC Visual Source Safe Source Code Control 
    HLP Windows Help file
    MST Windows Installer Setup Transform .MST (FileType 2023-03-01 and above)
    URL Windows Internet shortcut
    EVT Windows NT event log
    REG Windows Registry Data
    WSF Windows Script File .WSF 
    LNK Windows shortcut
    EVTX Windows Vista event log .EVTX 
    XML XML Document (recognized from FileType 8.2.1; selectable in the user interface from Filetype 8.2.2)

    Sound

    Type Name Description
    AAC AAC audio 
    FLSA Adobe Flash Audio 
    AU AU sound file
    ENC Encore Music Notation .ENC 
    ASX Microsoft Active Streaming link
    MID MIDI sound file
    MP3 MP3 sound file
    OGA OGG stream for audio 
    RAM Real Audio Link
    RA Real Audio sound file
    RMP Real Jukebox Metadata Package
    Real RealPlayer audio/video
    WAV WAV sound file
    ASF Windows Active Streaming Format

    Video

    Type Name Description
    3GPP 3GPP Video
    FLSV Adobe Flash Video
    FLC Animator Pro FLC file
    FLI Animator Pro FLI file
    AVI AVI video
    DVM DVM video
    ASX Microsoft Active Streaming link
    MOV Mov video
    MPG Mpeg video
    OGV OGG stream for video 
    Real RealPlayer audio/video
    SWF Shockwave Flash
    FLV Shockwave Flash video
    WEBM WebM Video File (from FileType 8.2.1)
    ASF Windows Active Streaming Format

    Web Browsing

    Type Name Description
    CSS Cascading style sheet
    CRL Certificate Revocation List (CRL)
    GIF GIF Image 
    Goog Google Safe Browsing Update
    HTML HTML Document
    ICO Icon
    CLASS Java class file
    JS JavaScript file
    JPG JPEG image
    OCSPResponse OCSP Response File
    PNG PNG image
    SWF Shockwave Flash
    VBS VBScript file (from FileType 8.2.1)
    FORMBIN Web Page binary form data
    FORMTEXT Web page text form data
    WEBM WebM Video File (from FileType 8.2.1)
    WEBP WebP Image File (from FileType 8.2.1)

    Non-Selectable Types

    The following types cannot be selected in rules. They are used internally by WebMarshal and will be shown in logs as appropriate.

    Type Name Description
    BIFF12 Binary File Format for Office 12
    CHMBINOBJ CHM Binary Object
    ODTCache Open Document Text Layout-cache
    OLEStream OLE Raw Stream
    PDFStream PDF Raw Stream 
    ZIPBig Zip with massively redundant data

    Notes:

    • PDF files that do not begin with the string %PDF (header in the document source) do not comply with the PDF standard. These files are recognized separately.
      • Note that recent versions of Adobe software enforce compliance with the standard. For more information see Adobe documentation.
    • Word, Excel, and Powerpoint "2007" file type is the default format used by all later versions (including Office 2010, 2013, and 2016). All documents saved in this format are recognized, regardless of the Office software version.
    • See the following Trustwave Knowledgebase articles for information about other versions:
      • Q12033 What file types are recognized by WebMarshal 6.X?
      • Q10859 What file types are recognized by WebMarshal 3.X?

    To contact Trustwave about this article or to request support:

    Rate this Article:
         

    Related Articles


    Q10859 INFO: What file types are recognized by WebMarshal 3.X?
    Q12033 INFO: What file types are recognized by WebMarshal 6.X?

    Add Your Comments


    Comment submission is disabled for anonymous users.
    Please send feedback to Trustwave Technical Support or the Webmaster    .


    Execution: 0.078. 12 queries. Compression Disabled.
    Powered by InstantKB.NET