Malware protection defends your endpoints from viruses, trojans, worms, spyware, adware, key loggers, rootkits, phishing software, and other potentially unwanted programs (PUP). Malware protection comprises a signature and heuristic detection (antivirus) engine and MalwareGuard, a machine learning model to add another layer of protection against portable executable (PE) files.
MalwareGuard uses static analysis to detect malware, including ransomware and new malware variants, on execute in near real-time for portable executable (PE) files. (PE is a file format associated with exe, dll, sys, drv, mui, cpl, and scr files in both 32-bit and 64-bit versions of the Windows operating system.)
Note
Malware detection is supported for Endpoint Security (HX) Agents running version 24 or later in specific Windows environments, version 32 or later in macOS environments, and version 34 for Linux environments.
Malware prevention (quarantine and remediation) is supported for Endpoint Security (HX) Agents running version 26 or later in specific Windows environments.
Malware detection is supported for Scan-Now feature for endpoints running in Linux environments, but malware remediation is not supported.
Both on-access and on-demand (scheduled) malware scans are supported
On-access malware scans occur when files are created, executed, or opened. Created files include files that are downloaded from an Internet browser, new files created on the host by any process, files extracted from archives, and files created by a copy and paste action. Executed files are files that launch a process. Opened files include existing files opened from Windows Explorer, from media such as a USB or CD/DVD drive, and from network folders.
On-demand (scheduled) malware scans can be scheduled by time or event. Full scans and memory scans (which scan running processes) can be requested. New scans will not run if a previously scheduled scan is still running. Depending on how you configure your malware scan settings, end users can pause or cancel a running scheduled scan.
Malware protection automatically detects malware in any file in your environment, subject to the file size limitations shown below.
Type of scan | Size limit Antivirus / MalwareGuard |
|---|---|
On-access | 30 MB / 12 MB |
On-demand | 2 GB / 100 MB |
Caution
Although you can modify the file size limits using the API, increasing the values for Max File Size or Scan Timeout may impact system performance.
By default, malware detection and malware prevention (remediation and quarantine) are disabled. When malware detection is disabled, no malware protection occurs.
The source malware definition updates used by the Trellix malware protection engines can be downloaded from Trellix servers and require a direct Internet connection. They are not available in the Trellix’s Dynamic Threat Intelligence (DTI) cloud.
When the Endpoint Security (HX) xAgent starts an update, it picks a random interval for the content download between 0 and the configured polling interval, which by default 14400 seconds (4 hours). If the download does not succeed, or the content is corrupt, the Endpoint Security (HX) xAgent retries the download at another random interval. Once the download succeeds, the update process stops until the next Malware Definition Rules interval.
Choose a method for downloading malware definitions:
Internet (default): Download malware definition updates using a direct Internet connection to the Trellix malware definition servers.
HX Only: Download malware definition updates using a proxy server. This is supported in Trellix Endpoint Security Agent version 26 or later.
HX Preferred: Download malware definition updates using a proxy server. This is supported in Trellix Endpoint Security Agent version 26 or later.
Custom Source: Download malware definition updates from a custom location to avoid Internet usage.
At regular intervals, false-positive malware information is automatically downloaded from Trellix's Dynamic Threat Intelligence (DTI) cloud to the Endpoint Security (HX) server. When the Endpoint Security (HX) Agents poll the appliance, the false-positive data is automatically applied on the endpoints. Existing alerts on the Endpoint Security (HX) that match the false positive conditions are marked as false positive.
When malware is detected, a malware alert is generated and is visible in the Endpoint Security (HX) Web UI. Based on your configurable malware protection settings, you can request that any of the following remediation actions can be performed.
The infected file can be automatically quarantined in a quarantine area. When you turn on remediation (quarantine) actions, this happens automatically. Quarantined files are stored in a quarantine area and are deleted after a configurable aging period. Aging quarantined files helps prevent space problems. Analysts can acquire, delete, and restore quarantined files as needed.
Attempts can be made to clean (remove) the infection from the file. Files that cannot be cleaned are removed from the endpoint system. Files that are successfully cleaned are not quarantined.
End users can be notified when an infected file is quarantined or cleaned.
Malware traces (artifacts created by the malware) can be removed and reverted, as appropriate.
Note
Alerts generated by MalwareGuard have a unique subtype ("mg") to distinguish them from Antivirus detected alerts (subtype "av"). You can filter alerts by subtype in the /alerts API.
Alerts produced for malware rules are aged in the same manner as indicator of compromise (IOC) or exploit rules. See Indicator and alert aging. Malware alerts do not trigger an automatic triage, as other alerts do.
Important
Trellix strongly recommends that you create malware protection process and folder exclusions for any third-party antivirus software you have installed on your host endpoints. You must provide the full path of the process you want to exclude. If you only provide the executable file name, the process will not be excluded. This will maximize performance, ensure compatibility with other antivirus software, and reduce the number of duplicate alerts you receive from the Endpoint Security (HX) malware protection feature and your third-party antivirus software. Use the malware protection global policy to define these exclusions. See "Defining the Malware Protection global policy" in the Endpoint Security Agent (HX) Administration Guide.
In addition, allow list the Endpoint Security (HX) files in your third-party antivirus software, as described in "Excluding agent files in your antivirus software" in the Endpoint Security Agent (HX) Administration Guide.
For example, if you are running Symantec Endpoint Protection (SEP), you should create exclusions in SEP for Endpoint Security (HX) xAgent processes and folders. In addition, you should create exclusions for SEP processes and folders in the Endpoint Security (HX) xAgent malware protection global policy.
You can define policies and settings for malware protection that are specific to your organization. Using these policies and settings, you can:
Enable or disable malware detection for all host endpoints or for selected host sets
Enable or disable remediation (quarantine) actions for all host endpoints or for selected host sets
Create a global malware policy, specific to your installation for all host endpoints, that allows you to specify global malware protection options
Create an exception malware policy for selected host sets
Specify how long quarantined files are retained in the quarantine area
Enable or disable scan on install
Enable or disable scheduled scans and define up to ten global scheduled scans and up to ten exception scheduled scans
Specify whether or not scheduled scans can be cancelled or paused by endpoint users and define the pause duration and frequency for scheduled scans
For information about defining malware protection policies and settings and about managing malware protection, including MalwareGuard, see the Endpoint Security Agent (HX) Administration Guide.