Offline detection in HEP

[kanah]

Can I confirm that an attack that can be detected offline by HEP is when you already know the signature?

[Chris_Atkinson]

Detection based on signatures is one but not the only approach that is valid in such as case.

[kanah]

Thank you for your prompt reply. What are other approaches? 

[Chris_Atkinson · Accepted solution]

Anti-ransomware, Behavioral Guard, Port protection, Firewall each offer mitigations.

To this end you've not qualified if the client is permanently or temporarily offline.