Crylock

Well as you know, Crypoguard can detect such behaviour without signatures so you are most likely covered there.  That said, for things that have been around a while, it's good to stop them earlier than letting them run to observe behaviour. 

I did a quick search online for a hash of something that was detected as crylock and found:

https://www.virustotal.com/gui/file/b12b6892a6bec7d1cec43811e686cc6874988a51f4e64b67c7f5906af40fae26/detection

You can see that Sophos both the ML and regular scanner data found that, the other vendors seem to have Crylock in the names.

Hope it helps.

Edit: There is also this page: https://news.sophos.com/en-us/2020/08/04/the-realities-of-ransomware-why-its-not-just-a-passing-fad/ That references Crylock so I think it's fair to say Sophos are "aware" of it.

Thanks, you have gotten farther than I did.  I do miss the days where you could put in a variant name and determine who protected against it (competitive product).  And without an active issue, is hard to confirm with Sophos Labs as they have nothing to go by.  Appreciate the follow up. 

Thanks, you have gotten farther than I did.  I do miss the days where you could put in a variant name and determine who protected against it (competitive product).  And without an active issue, is hard to confirm with Sophos Labs as they have nothing to go by.  Appreciate the follow up. 

Sophos News and NakedSecurity are always a good way to go for "prominent" attacks. 

Likely if a press or other news site is reporting about a attack, Sophos already covered those attacks.

Check: 

https://news.sophos.com/en-us/

https://nakedsecurity.sophos.com/

https://community.sophos.com/b/security-blog