# Overview

**Anti-Ransomware, Endpoint Central's ransomware protection, is designed to detect, alert on, and mitigate ransomware and potential breaches promptly**.

This module provides reactive protection by deploying capabilities such as:

- **Detection** of suspicious file activity by leveraging behavior analysis, patented technology assisted by machine learning.
- **Restoration** of files upon a single click.
- Ensuring **endpoint security 24x7**, including offline protection to safeguard against threats even when disconnected from the internet.
- Zero definition updates, meaning **no downtime**.
- **Detection accuracy** by leveraging patented technology, leading to fewer false positives.
- **Instant alerts** on ransomware detection, and fundamental analysis from the console.

https://www.youtube-nocookie.com/embed/y5pvTkYrLo8?controls=0

## Detection

Anti-Ransomware's behavioral detection is driven by multi-patented technology, which has been specifically designed to reduce false positives and improve the accuracy of ransomware detection. The tool constantly monitors the system in real time, allowing for swift detection of ransomware attacks as they occur.

Upon detecting a process with ransomware-like behavior, the tool immediately issues a detection alert and proceeds to quarantine the affected machine within seconds. Ransomware typically involves accessing and encrypting a large number of files on the system. The tool detects ransomware attacks by analyzing the behavioral patterns associated with such activities. The detection accuracy reduces false positives to a minimum of 1%.

## Response

In the event of a potential ransomware intrusion, prompt response is crucial for preventing security breaches within your enterprise. With Endpoint Central's centralized console, you can efficiently analyze and respond to alerts. These alerts can be classified as either true or false positives, with a true positive indicating an actual attempted ransomware intrusion, and a false positive denoting an invalid alert.

However, it's essential to conduct a thorough analysis of any attempted intrusions before marking them as false positives, as they could still pose serious security risks. After marking the alert as a true positive, Endpoint Central initiates restoration of encrypted files to address the ransomware intrusion and minimize the damage caused by the attack.

## Analysis

An alert is issued to admins when a ransomware intrusion is suspected. Responding to a ransomware alert is a crucial step since it involves analyzing the intrusion and recovering affected data.

Analyzing a ransomware intrusion can be done seamlessly by verifying the information present inside the console, which includes:

- Process tree
- Binary information
- Vendor reviews and SHA information via VirusTotal
- Infected device information
- Signer certificate

Analyzing an intrusion before marking it as true/false positive will also help maintain security standards. Marking an intrusion as false positive may cause security issues; hence analyzing an incident is advised.

## Recovery

Having a backup of critical files is crucial during a ransomware attack as attackers can compromise or encrypt these files, making them inaccessible or unusable. However, some attackers have started targeting backups to prevent organizations from recovering their files. For example, the Conti ransomware group exfiltrates backups before encrypting files on a system.

To combat this threat, backup protection is essential. Anti-Ransomware offers patented technology to protect backups by leveraging Microsoft's VSS service to obtain shadow copies of all files on an endpoint, which can be used to restore files to their pre-attack state in just one click. With backup protection, only infected files are reverted to the most recent copy of the file saved, reducing the impact of the attack.