GovCERT-CH Blocked Filetypes: TLCTC Analysis & Restructured List

The GovCERT-CH Original Categories

The original list uses these categories:

• Archive files
• Code files
• Executables
• Media files
• Microsoft Office / OpenDocument
• Other

TLCTC Critique: These categories are based on format function rather than threat mechanism. A more principled approach classifies by how the format achieves execution—which directly determines the appropriate control strategy.

TLCTC Three-Tier Restructured List

TIER 1: Native/Direct FEC (pure #7)

Threat Mechanism: The OS loader or runtime directly executes the file. The file IS the Foreign Executable Content. No intermediate application processing required.
Control Strategy: Block execution (application allowlisting, SmartScreen, email gateway blocking). The control question is: "Should this code be allowed to run?"
Attack Velocity: Fastest—execution occurs immediately upon invocation.

Windows PE Executables

Windows Script Files (Direct Interpreter Execution)

Unix/Cross-Platform Scripts

Java/JVM & Windows Installer/Package

Shortcut/Reference Files (Execution Indirection)

Platform-Specific Executables

TIER 2: Application-Mediated FEC (#1 → #7)

Threat Mechanism: An application processes the file through its designed functionality (#1 Abuse of Functions), which then enables embedded code execution (#7). The file ENABLES execution through a legitimate feature.
Control Strategy: Disable the enabling feature (macros, scripting, active content). Multiple intervention points exist in the chain. The control question is: "Should this feature be enabled for this content?"
Attack Velocity: Intermediate—requires application to process file, then execute embedded content.

Microsoft Office (Macro-Enabled) & Legacy Formats

OpenDocument, HTML, PDF & Server-Side

Database & Configuration Files with Execution

TIER 3: Data Formats Requiring Parser Exploits (#2/#3 → #7)

Threat Mechanism: No designed execution capability. Code execution requires exploiting an implementation flaw (buffer overflow, heap corruption, integer overflow, etc.) in the parser, codec, or renderer.
Control Strategy: Patch parsers, sandbox processing, use memory-safe implementations. The control question is: "Is my parser implementation safe?" Blocking is defense-in-depth but does NOT address the root vulnerability.
CRITICAL INSIGHT: For Tier 3, an exhaustive blocklist is impossible. ANY file format with a parser is a potential attack surface. The GovCERT list's inclusion of these formats creates false confidence if blocking is seen as the primary control.

Image, Video, Audio & Documents

Fonts, Archives & Serialization

Missing File Types Summary

Critical Additions for Tier 1 (Must Block)

• PowerShell modules: .psd1, .psm1
• Python (increasingly common): .py, .pyc, .pyw, .pyz, .pyzw
• Modern Windows/Deployment: .msix, .appx, .appxbundle, .application, .appref-ms, .settingcontent-ms
• System & Script: .sys, .drv, .cpl, .efi, .msc, .sct, .scf, .inf
• Mobile: .apk, .ipa

Critical Additions for Tier 2 (Should Block/Disable Feature)

• Excel specifics: .xlsb, .xlam, .xla, .xll, .slk, .iqy, .dif
• Access databases: .accdb, .accde, .mdb, .mde
• Execution capable: .chm, .svg, .reg, .gadget, .diagcab
• Server-side: .aspx, .asmx, .php, .jsp

Tier 3 Additions (Parser Vulnerability Surface)

• Fonts: .ttf, .otf, .woff, .woff2, .eot
• Modern Images: .webp, .heic, .heif, .avif
• Legacy Vectors: .emf, .wmf
• Serialization/Compression: .yaml, .yml, .pickle, .pkl, .zst, .lz4

The Fundamental Problem with the GovCERT Approach

The GovCERT-CH list, while operationally useful, exhibits several conceptual problems when analyzed through TLCTC:

1. Conflation of Threat Mechanisms: Grouping by format category (archives, media) ignores that Tier 1 formats are dangerous BY DESIGN, Tier 2 are dangerous BY FEATURE, and Tier 3 are dangerous BY BUG.
2. False Confidence Through Tier 3 Blocking: Blocking .jpg at the email gateway creates false confidence. Users still encounter images on websites, USB drives, etc. The real control is patching parsers (libjpeg, libpng).
3. Incomplete Tier 1 Coverage: Missing critical FEC-capable formats like the Python ecosystem and modern Windows packages leaves gaping holes.
4. No Contextual Differentiation: The list cannot express that .exe in a CI/CD pipeline is expected, while .exe in email is suspicious. TLCTC's boundary notation (||[context][@Source→@Target]||) enables this differentiation.

Recommended Control Strategy by Tier

Conclusion

The GovCERT-CH list is a valuable operational resource, but its effectiveness is limited by conceptual conflation. Organizations should:

• Classify their blocklist by TLCTC tier to understand why each format is blocked.
• Ensure complete Tier 1 coverage — these are the formats that matter most.
• Implement Tier 2 feature controls — blocking alone is insufficient.
• Recognize Tier 3 limitations — blocking is defense-in-depth, not the primary control.

The file extension is just a hint—the threat model is what matters.