Would Traps be able to detect and kill this file on the host without requiring any manual remediation?

[Retired Member]

A customer is seeing infected word files with macro in their network. The firewall is not able to block this file because the macro keeps changing file hash, even with WildFire enabled.

Would Traps be able to detect and kill this file on the host without requiring any manual remediation?

[hyadavalli]

Hello Emma,

It depends on the policy pushed to the client machine whether word process is protected or not.

If it is then yes, Traps will detect the exploit and won't display the file.

Regards,

Hari Yadavalli

[pulukas]

Note that TRAPS works in a completely different way than current AV products.  AV using signatures that are evaded by the technique you note.  TRAPS watches the actual behavior against exploit behavior and stops the action or logs the activity.

Advanced Endpoint Protection Overview

[gafrol]

As already said, if the macro is malicious (exploit vulnerabilty on the endpoint) then most probably Traps will stop it from happening. I made a short video to demo Traps preventing an endpoint from being exploited by a vuln. in Adobe Flash just to give an idea.

Traps - Advanced Endpoint Protection by Palo Alto Networks - YouTube

One of the key advantages of Traps is that it does not require any remediation after prevention, although the malicious files should get deleted/quarantined on the endpoint once a legacy AV solution has a signature....