Ransomware Question

[Saeedullah Khan]

Hi Guys,

Can anyone confirm, is AMP can stop spam emails micro enabled (ransomware) attachments or we need to also buy the SPAM license?

Waiting for your prompt reply.

[David Janulik]

Hi Khan,

AMP checks files with following extensions.

• MSEXE
• PDF
• MSCAB
• MSOLE2
• ZIP
• ELF
• MACHO
• MACHO_UNIBIN
• SWF
• JAVA

 Unsupported File Types

Windows Connector currently does not scan ELF, JAVA, xar(pkg), MACHO, MACHO_UNIBIN, or ASCII.

The file disposition will be checked against cloud. To reduce spam, you should probably look for Email security appliance (ESA) product.

David

[Saeedullah Khan]

Thanks for your reply.

Actually, spam received ".docm, .xlsm" extension files and when opened the file, they encrypted the mostly word/excel files.

Can AMP will control this issue?

Saeed

[David Janulik]

Can you open a support case? We can check the file disposition convicted at the time you opened it. From your side do the file trajectory investigation. This should help you to track down executed actions from it.

David