topic Ransomware Question in Endpoint Security

Ransomware Question

Saeedullah Khan — Fri, 21 Feb 2020 05:02:58 GMT

Hi Guys,

Can anyone confirm, is AMP can stop spam emails micro enabled (ransomware) attachments or we need to also buy the SPAM license?

Waiting for your prompt reply.

Hi Khan,

David Janulik — Tue, 13 Dec 2016 09:19:54 GMT

Hi Khan,

AMP checks files with following extensions.

MSEXE
PDF
MSCAB
MSOLE2
ZIP
ELF
MACHO
MACHO_UNIBIN
SWF
JAVA

Unsupported File Types

Windows Connector currently does not scan ELF, JAVA, xar(pkg), MACHO, MACHO_UNIBIN, or ASCII.

The file disposition will be checked against cloud. To reduce spam, you should probably look for Email security appliance (ESA) product.

David

Thanks for your reply.

Saeedullah Khan — Tue, 13 Dec 2016 09:33:07 GMT

Thanks for your reply.

Actually, spam received ".docm, .xlsm" extension files and when opened the file, they encrypted the mostly word/excel files.

Can AMP will control this issue?

Saeed

Can you open a support case?

David Janulik — Tue, 13 Dec 2016 09:46:35 GMT

Can you open a support case? We can check the file disposition convicted at the time you opened it. From your side do the file trajectory investigation. This should help you to track down executed actions from it.

David