First off,
I had a hard time getting malware activated. I had a linux virtual server downloading malware using Maltrieve (git) and a Windows 7 VM downloading the malware from that linux server to be executed. In between the 2 VM's and in between the VM's and the physical network I had a virtual Sophos UTM. The linux vm was allowed to downloaded bypassing all checks, the Windows 7 VM initially had its traffic scanned by the Sophos UTM so I would only get malware inside the Windows 7 currently undetected by Sophos. Unfortunately all malware got blocked by the Sophos UTM as CXweb/ExplPE-D: https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/CXweb~ExplPE-D.aspx After disabling the scanning HTTP on the Sophos UTM between the 2 VM's I found out that the local Sophos Web Protection of the WIN7 VM gave the same protection :).
I ended up disabling Sophos Web Protection and eventually alltogether the on-access scanner, good job!
Now the feedback:
1. On the Threat Analysis page, when you click a threat you get Threat Analysis Details. At Next Steps the text gets wrapped based on resolution of screen. This breaks words.
2. The Threat Analysis seems to capture unrelated activity, which results in the question... how is the data captured for the analysis and when does the capture start?
3. I experienced high CPU and memory usage on the test system during my testing, what is the expected performance impact of the analysis?
4. It looks like the Threat Analysis is only for Windows Workstations, is there going to be server support?
Will be doing some more testing, want to see how an analysis looks like after the protection gets added when the malware has been active for a while.
This thread was automatically locked due to age.
