topic Re: Would Traps be able to detect and kill this file on the host without requiring any manual remediation? in General Topics

Would Traps be able to detect and kill this file on the host without requiring any manual remediation?

Retired Member — Fri, 06 Mar 2015 01:45:50 GMT

A customer is seeing infected word files with macro in their network. The firewall is not able to block this file because the macro keeps changing file hash, even with WildFire enabled.

Would Traps be able to detect and kill this file on the host without requiring any manual remediation?

Re: Would Traps be able to detect and kill this file on the host without requiring any manual remediation?

hyadavalli — Fri, 06 Mar 2015 15:36:43 GMT

Hello Emma,

It depends on the policy pushed to the client machine whether word process is protected or not.

If it is then yes, Traps will detect the exploit and won't display the file.

Regards,

Hari Yadavalli

Re: Would Traps be able to detect and kill this file on the host without requiring any manual remediation?

pulukas — Sat, 07 Mar 2015 12:52:49 GMT

Note that TRAPS works in a completely different way than current AV products. AV using signatures that are evaded by the technique you note. TRAPS watches the actual behavior against exploit behavior and stops the action or logs the activity.

Advanced Endpoint Protection Overview

Re: Would Traps be able to detect and kill this file on the host without requiring any manual remediation?

gafrol — Tue, 10 Mar 2015 14:37:51 GMT

As already said, if the macro is malicious (exploit vulnerabilty on the endpoint) then most probably Traps will stop it from happening. I made a short video to demo Traps preventing an endpoint from being exploited by a vuln. in Adobe Flash just to give an idea.

Traps - Advanced Endpoint Protection by Palo Alto Networks - YouTube

One of the key advantages of Traps is that it does not require any remediation after prevention, although the malicious files should get deleted/quarantined on the endpoint once a legacy AV solution has a signature....