# How to read an encrypted quarantine file? **URL:** \ **Category:** Endpoint Security\ **Created:** [May 3, 2024, 1:35pm UTC](https://discuss.elastic.co/t/how-to-read-an-encrypted-quarantine-file/358714 "2024-05-03T13:35:49Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![lamp123432](https://avatars.discourse-cdn.com/v4/letter/l/7993a0/32.png) [@lamp123432](https://discuss.elastic.co/u/lamp123432)\ **Post date:** [May 3, 2024, 1:35pm UTC](https://discuss.elastic.co/t/how-to-read-an-encrypted-quarantine-file/358714/1 "2024-05-03T13:35:49Z")
Hello, there's a malware on an endpoint I manage, Elastic Defend put that malware in `C:\.equarantine\xxxxxxxxxxxxxxxxxxxxxxx` something like that. I went there and grabbed the file for analysis in my sandbox. It is an encrypted file, I want to decrypt it so I can analyse the malware in my sandbox. I found the following: [Configure an integration policy for Elastic Defend | Elastic Security Solution [8.13] | Elastic](https://www.elastic.co/guide/en/security/current/configure-endpoint-integration-policy.html#manage-quarantined-files) There, it says this: > When Prevent is enabled for malware protection, Elastic Defend will quarantine any malicious file it finds. Specifically Elastic Defend will remove the file from its current location, encrypt it with the encryption key ELASTIC, move it to a different folder, and rename it as a GUID string, such as 318e70c2-af9b-4c3a-939d-11410b9a112c. So we know the encryption key is ELASTIC. Now, how to decrypt? What's the cypher? And before anyone suggests it: No, I will not add an endpoint exception to "restore" the malware on the endpoint. I want to grab the malware from quarantine and analyse it in my sandbox, Elastic documentation even tells us how to do that: > You can access a quarantined file by using the `get-file` [response action command](https://www.elastic.co/guide/en/security/current/response-actions.html#response-action-commands) in the response console. To do this, copy the path from the alert’s **Quarantined file path** field (`file.Ext.quarantine_path` ), which appears under **Highlighted fields** in the alert details flyout. Then paste the value into the `--path` parameter. This action doesn’t restore the file to its original location, so you will need to do this manually. Cool! But file is encrypted with encryption key ELASTIC, what's the cypher, how to decrypt? ---
**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\ **Post date:** [May 3, 2024, 3:56pm UTC](https://discuss.elastic.co/t/how-to-read-an-encrypted-quarantine-file/358714/2 "2024-05-03T15:56:27Z")
Hi @lamp123432 I opened a [documentation update request](https://github.com/elastic/security-docs/issues/5157) for that page to clarify the encryption scheme and how `get-file` works. The `ELASTIC` encryption for the quarantined file is a rolling XOR. The file is XOR'd with the repeating pattern `ELASTIC` to prevent it from being runnable, not to prevent your ability to do exactly what you're trying to do. `get-file` automatically undoes that XOR, so if you use the `get-file` response action after you unzip the retrieved file there will be no XOR to undo. You can verify that by hashing the retrieved file and comparing that hash to the hash in your original alert. I hope that all helps and makes sense. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 31, 2024, 3:57pm UTC](https://discuss.elastic.co/t/how-to-read-an-encrypted-quarantine-file/358714/3 "2024-05-31T15:57:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.