topic Does Cisco Amp scan for rootkits? in Endpoint Security

Does Cisco Amp scan for rootkits?

kristina.robinson — Tue, 14 Dec 2021 17:25:03 GMT

My organization has Cisco Amp for endpoint protection. The question we have is whether Amp scans for rootkits? We are also seeing a very high number of executable files show up as potential threats. Does Amp flag all ".exe" files as threats? Excel spreadsheets and system files are also showing up as potential threats. Does Amp flag all .xlsx files and system files as potential threats as well?

Re: Does Cisco Amp scan for rootkits?

Troja007 — Tue, 14 Dec 2021 18:15:31 GMT

Hello @kristina.robinson ,
so let me try to answer your questions step-by-step

Rootkit Scan: Yes we do. There is an own OnDemand Scan available on the endpoint. Thought this has been already fixed in the console.
Potential Threats: What type of Events are shown exactly? And no, Secure Endpoint does not flag all .exe files as threats. 🙂
All Engines also include "guardrails" to prevent False/Positves.
File Scanning: The graphics below shows how Secure Endpoint protects against threats. For File Scanning the endpoint does several steps to detect malicious files. The Device Trajectory shows more information which engines processed a file and which engine triggered a detection. There are some aspects which have an impact on the detection. This can be the cache or configured exclusions.

So finally, Secure Endpoint does not mark executable code or office documents as threats. Especially system files, as we use the guardrails to prevent the system from false/positives. I would suggest to open a TAC case so someone takes a deeper look into your environment. Based on your description I cannot provide any reliable statement what is going on on your endpoint.

Greetings,
Thorsten

Re: Does Cisco Amp scan for rootkits?

kristina.robinson — Tue, 14 Dec 2021 19:18:16 GMT

Hi!

So are you saying that when I run full scans in Amp, it is automatically checking for rootkits as well or is there a separate scan to run for rootkits?

Re: Does Cisco Amp scan for rootkits?

Troja007 — Wed, 15 Dec 2021 08:18:22 GMT

Hello @kristina.robinson ,
looks like there is an issue in the Console UI. So you can start a Rootkit scan on the endpoint, but not remotely from the console. You may check with TAC to get this solved.
Greetings,
Thorsten