> Source: [sk170795](https://support.checkpoint.com/results/sk/sk170795)

# sk170795 - Check Point Response to the SNIcat tool

| Property | Value |
|----------|-------|
| Solution ID | sk170795 |
| Date Created | 2020-12-02 |
| Last Modified | 2025-02-09 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- The Mnemonic company published a tool for bypassing HTTPS Inspection on various firewalls, **not including Check Point Security Gateway**.

Read the full report "SNIcat: Circumventing the guardians" at <https://www.mnemonic.no/blog/introducing-snicat>.

## Solution

Check Point's HTTPS Inspection and Threat Prevention has multiple layers of defense that block the use of the SNIcat tool, and do not allow this attack vector to bypass our Security Gateway.  

Yet, when there is already malicious software running inside the network, modifications of the SNIcat tool may be able to overcome some of the defenses. To avoid this, in addition to enabling all Threat Prevention blades and HTTPS Inspection, Check Point also recommends:  

1. The use of Check Point Endpoint Security.
2. A hardened rule-base that includes blocking uncategorized destinations and HTTPS Inspection working in the "Hold" mode.

<br />

In addition, Check Point has developed the following protections to catch the SNIcat tool traffic:  

**SandBlast Agent**   

* Trojan.Win.Snicat.A
* Trojan.Win.Snicat.B

<br />

**Threat Emulation**   

* Trojan.Wins.Snicat.C
* Trojan.Wins.Snicat.D  

**Application Control**   

* SNIcat (Server Name Indication Concatenator)
* Part of the Anonymizer category

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content