Learn about the different Behavior Monitoring detection component features.
Unauthorized File Encryption is a Behavior Monitoring feature that blocks unwanted file encryption or modification which can indicate a potential ransomware behavior.
Login to OfficeScan server web console.
In the Agent Tree, select OfficeScan Server/Domain/Computer.
Go to Settings > Behavior Monitoring Settings.
Select "Protect documents against unauthorized encryption or modification". Then under this option select "Automatically back up files changed by suspicious programs".
This feature requires Unauthorized Change Prevention Service to be enabled. You may enable this under Agent > Agent Management > Settings > Additional Services Settings.
Select "Enable Malware Behavior Blocking".
Compromised Executable File is a behavior monitoring detection leveraging ATSE (Advance Threat Scan Engine) heuristics for programs that exhibits abnormal behavior associated with exploit attacks.
Select "Enable program inspection to detect and block compromised executable files".
Newly Encountered Program recognition is a feature designed to help prevent 0-day attacks. TrendMicro classifies a program as newly encountered based on the number of file detections or historical age of the file as determined by the Smart Protection Network.
Go to Agents > Agent Management > Settings > Additional Services Settings.
Put a check on "Monitor newly encountered programs downloaded through web or email application channels" and click Apply to All Agents.
In the management console, go to Agents > Agent Management > Settings > Web Reputation Settings.
Select "Enable Web reputation policy on the following operating systems".
In the management console, go to Agents > Agent Management > Settings > Scan Settings > Real-time Scan Settings.
TM_MALWARE_BEHAVIOR is a behavior monitoring detection for system activities or behaviors associated with known and potential malware traits.
In the management console, go to Policies > Policy > Anti-Malware > Real-Time > Malware Scan Configuration > Edit > General > Behavior Monitoring.
Select "Detect suspicious activity and unauthorized changes".
HEU_AEGIS_CRYPT is a behavior monitoring ransomware protection feature that blocks possible unwanted document file encryption or modification which can indicate a potential ransomware malware encryption behavior.