Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

CB Defense: Why didn't the sensor catch ransomware simulation tests?

CB Defense: Why didn't the sensor catch ransomware simulation tests?

Environment

  • CB Defense Sensor: All Versions
  • CB Defense Console: All Versions

Question

Why didn't the sensor terminate tests run by ransomware simulators?

Answer

Many ransomware simulators will run in an isolated folder created by the simulation rather than touching true user files. Defense will log updates to these files, but will not consider it ransomware until an actual user file is touched. 

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎02-05-2019
Views:
428
Contributors