Hello, good day, My question is oriented to the Antiramsomware module for the solution of Sandblast Agent, there would be some conflict with a solution like PGP at the time when a file is encrypted by means of PGP, that would happen with the Antiramsomwa

[Mauricio_Andres]

Hello, good day,

My question is oriented to the Antiramsomware module for the solution of Sandblast Agent, there would be some conflict with a solution like PGP at the time when a file is encrypted by means of PGP, that would happen with the Antiramsomware module, in this case would act ?? Or as required so that it is not activated under this activity.

[PhoneBoy]

Sorry for the delayed response.

In general, we should not trigger if you use PGP.

Typical PGP use cases will involve encrypting a file and storing the encrypted file as a pgp file. The original file itself will not be modified. This will not trigger AR.

Even if the original file is modified it would take a lot of such files to be modified for their to be a detection.

If you find it does, we can work the issue through support.

[Javier_Padilla]

There is always a context around a Ransomware attack. SBA is not looking if the file is encrypted, because Ransomware not always encrypt, so you will not be able always to restore files even when a ransom is payed. SBA looks for automated attempts to modify the files, but also needs to define if that modification was because a Ransomware attack, so it will start analyzing all activities around. Once the context is defined and the model created, the restoration can happen. 

If you are just encrypting a file, there is no context or indicators around you to believe there is an attack and trigger analysis.