AMP for Endpoint

[abbasali5]

Does AMP for Endpoints  have any native memory-based malware blocking capability?

Not looking for detection, but active protection for memory based malware without the use of CTA?

Thanks,

[David Janulik]

Hi,

The AMP itself is capable and primary works with files. The low prevalence files may be automatically submitted for File Analysis in the Threat Grid cloud. This evaluates all file artifacts, file activity, Behavioral indicators. This should be the active protection for unknown files.

Best Regards

David

[NicholasLudwiczak]

It looks like the latest version of AMP, 6.0.5, released Dec 5, 2017 has some memory attack prevention.  Here are some excerpts from the release notes.

• Exploit Prevention detection engine to block exploits and memory attacks that target

certain processes.

•System Process Protection adds protection for memory attacks against certain Windows

system processes.

[Troja007]

Hello,

the new Malicious Activity Protection Engine and Exploit Prevention Engine are in place to cover such topics.

Cheers