Views:

Unauthorized File Encryption is a Behavior Monitoring feature that blocks unwanted file encryption or modification which can indicate a potential ransomware behavior.

Below is a sample detection:

Unauthorized File Encryption

Click the image to enlarge.

To enable the feature:

  1. Login to Apex One server web console.
  2. Go to Agents > Agent Management.
  3. Right-click the desired domain group or endpoint.
  4. Go to Settings > Behavior Monitoring Settings.
  5. Select "Protect documents against unauthorized encryption or modification". Then under this option select "Automatically back up files changed by suspicious programs".

    auto back up files

  6. Click Save or Apply to All Agents.
 
This feature requires Unauthorized Change Prevention Service to be enabled. You may enable this under Agent > Agent Management > Settings > Additional Services Settings.

additional settings

 

Malware Behavior Blocking is a security feature in OSCE that does the following:

  • For known threats, it blocks behavior associated with known malware threats
  • For known and potential threats, it blocks behavior associated with known threats and takes action on potentially malicious behavior

Below is a sample detection:

Malware Behavior Blocking

Click the image to enlarge.

To enable the feature:

  1. Login to Apex One server web console.
  2. Go to Agents > Agent Management.
  3. Right-click the desired domain group or endpoint.
  4. Go to Settings > Behavior Monitoring Settings.
  5. Select Enable Malware Behavior Blocking.

    Enable Malware Behavior Blocking

  6. Click Save or Apply to All Agents.
 
This feature requires Unauthorized Change Prevention Service to be enabled. You may enable this under Agent > Agent Management > Settings > Additional Services Settings.

additional settings

 

Compromised Executable File is a behavior monitoring detection leveraging ATSE (Advance Threat Scan Engine) heuristics for programs that exhibits abnormal behavior associated with exploit attacks.

Below is a sample detection:

Compromised Executable File Detection

Click image to enlarge.

To enable the feature:

  1. Login to Apex One server web console.
  2. Go to Agents > Agent Management.
  3. Right-click the desired domain group or endpoint.
  4. Go to Settings > Behavior Monitoring Settings.
  5. Select Enable program inspection to detect and block compromised executable files.

    abnormal behavior

  6. Click Save or Apply to all Agents.
 
This feature requires Unauthorized Change Prevention Service to be enabled. You may enable this under Agent > Agent Management > Settings > Additional Services Settings.

additional settings

 

Newly Encountered Program recognition is a feature designed to help prevent 0-day attacks. TrendMicro classifies a program as newly encountered based on the number of file detections or historical age of the file as determined by the Smart Protection Network.

Below is a sample detection:

Newly Encountered Program Detection

Click the image to enlarge.

To enable the feature:

  1. Login to Apex One server web console.
  2. Go to Agents > Agent Management.
  3. Right-click the desired domain group or endpoint.
  4. Go to Settings > Behavior Monitoring Settings.
  5. Put a check on Monitor newly encountered programs downloaded through web or email application channels.

    newly encountered programs

  6. Click Save or Apply to All Agents.

This feature requires the following to be enabled:

  • Unauthorized Change Prevention Service

    To enable the feature:

    1. Navigate to Agents > Agent Management.
    2. Right-click the desired domain group or endpoint.
    3. Go to Settings > Additional Services Settings.

      Unauthorized Change Prevention Service

  • Web Reputation

    To enable the feature:

    1. In the Apex One web console, go to Agents > Agent Management > Settings > Web Reputation Settings.
    2. Select Enable Web reputation policy on the following operating systems.

      Web Reputation

  • Apex One Real-time Scan

    To enable the feature:

    1. In the Apex One web console, go to Agents > Agent Management > Settings > Real-time Scan Settings.
    2. Select Enable virus/malware scan.

      Real-time Scan