Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Mauricio_Andres
Participant

Hello, good day, My question is oriented to the Antiramsomware module for the solution of Sandblast Agent, there would be some conflict with a solution like PGP at the time when a file is encrypted by means of PGP, that would happen with the Antiramsomwa

Hello, good day,

My question is oriented to the Antiramsomware module for the solution of Sandblast Agent, there would be some conflict with a solution like PGP at the time when a file is encrypted by means of PGP, that would happen with the Antiramsomware module, in this case would act ?? Or as required so that it is not activated under this activity.

0 Kudos
2 Replies
PhoneBoy
Admin
Admin

Sorry for the delayed response.

In general, we should not trigger if you use PGP.

Typical PGP use cases will involve encrypting a file and storing the encrypted file as a pgp file. The original file itself will not be modified. This will not trigger AR.

Even if the original file is modified it would take a lot of such files to be modified for their to be a detection.

If you find it does, we can work the issue through support.

Javier_Padilla
Employee Alumnus
Employee Alumnus

There is always a context around a Ransomware attack. SBA is not looking if the file is encrypted, because Ransomware not always encrypt, so you will not be able always to restore files even when a ransom is payed. SBA looks for automated attempts to modify the files, but also needs to define if that modification was because a Ransomware attack, so it will start analyzing all activities around. Once the context is defined and the model created, the restoration can happen. 

If you are just encrypting a file, there is no context or indicators around you to believe there is an attack and trigger analysis.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events