An administrator wants to prevent ransomware that has not been seen before, without blocking other processes.
Which rule should be used?

Question

An administrator wants to prevent ransomware that has not been seen before, without blocking other processes.Which rule should be used?

Jose Ortuondo Arambalza · Accepted Answer

[Not listed application] [Performs ransomware-like behavior] [Terminate process

Jose Ortuondo Arambalza · Answer

[Adware or PUP] [Scrapes memory of another process] [Deny operation]

Jose Ortuondo Arambalza · Answer

[Unknown malware] [Runs or is running] [Terminate process]

Jose Ortuondo Arambalza · Answer

[Not listed application] [Runs or is running] [Terminate process]

List of questions