Does Cisco's AMP open URLs in an attachment

[anotthak8]

Does Cisco's AMP open URLs in an attachment? For example, a Microsoft word document with a malicious URL inside.

Any insight or information will be helpful. Thank you.

[Paul Cardelli]

It's probably a bit more complicated then that, but I found this Cisco blog post from last year that may help explain their methods. AMP which was FireAMP at the time of the article.

Attackers-slipping-past-corporate-defenses-with-macros