topic Re: AMP for Endpoint in Endpoint Security

AMP for Endpoint

abbasali5 — Fri, 21 Feb 2020 05:04:20 GMT

Does AMP for Endpoints have any native memory-based malware blocking capability?

Not looking for detection, but active protection for memory based malware without the use of CTA?

Thanks,

Hi,

David Janulik — Mon, 12 Jun 2017 08:31:18 GMT

Hi,

The AMP itself is capable and primary works with files. The low prevalence files may be automatically submitted for File Analysis in the Threat Grid cloud. This evaluates all file artifacts, file activity, Behavioral indicators. This should be the active protection for unknown files.

Best Regards

David

Re: AMP for Endpoint

NicholasLudwiczak — Wed, 20 Dec 2017 13:00:41 GMT

It looks like the latest version of AMP, 6.0.5, released Dec 5, 2017 has some memory attack prevention. Here are some excerpts from the release notes.

• Exploit Prevention detection engine to block exploits and memory attacks that target

certain processes.

•System Process Protection adds protection for memory attacks against certain Windows

system processes.

Re: AMP for Endpoint

Troja007 — Thu, 11 Oct 2018 15:34:10 GMT

Hello,

the new Malicious Activity Protection Engine and Exploit Prevention Engine are in place to cover such topics.

Cheers