The appliance submits suspicious email attachments to the MVX (Multi-Vector Virtual Execution) engine, where suspicious binaries are detonated and further analyzed. By default, the MVX engine responds to requests for remote objects by returning dummy data rather than actual data. Some attacks can evade this type of detection.
The controlled live mode feature enables the appliance to detect malware that requires multiple downloads of remote objects. The feature is disabled by default and must be explicitly configured and enabled. In controlled live mode, communication between remote hosts and the sample binary is managed by the MVX engine. The MVX engine handles HTTPS-based requests as well as HTTP-based requests from sample binaries to remote objects.
Enabling controlled live mode has the effect of creating two additional MVX analysis rules:
When a sample binary requests a remote object, return real content—or as close to real content as possible—unless the payload is verified to be malicious.
Allow other communication between the sample binary and remote hosts—unless the payload is verified to be malicious.
Because controlled live mode causes the MVX engine to return the remote objects requested by the sample binary, the sample binary is unaware of the sandbox environment, and it behaves just as it would outside a sandbox. After the final download at the end of the infection chain, the malware has been downloaded or re-constructed. The MVX engine detonates the malware and detects the malicious actions. The environment is "live" in the sense that the analysis engine can return real content to the malware sample. The environment is "controlled" because secondary downloads are analyzed and blocked if verified to be malicious.
Controlled live mode supports the same email attachment file types and Trellix default whitelists as well as the other analysis capabilities of the appliance. File type support and default whitelists are dynamic and are managed though Trellix security content updates.
Controlled live mode reduces false negatives for following types of spam:
Malware delivered through multiple downloads from remote hosts
Advanced spear phishing attacks
Advanced ransomware intrusions