Adaptive Threat Protection monitors the behavior of files and processes with a reputation of Unknown (50) or lower. If a process exhibits malicious behavior, ATP performs remediation.
When the file or process reaches the configured reputation threshold, ATP performs the Clean action.
ATP traverses the process tree, stopping the last process that the convicted process created (such as the child or grandchild) and continuing to the process' ancestors (parent or grandparent).
ATP doesn't stop processes that are:
Considered critical processes, such as services.exe and wininit.exe.
ATP doesn't stop critical processes. If the critical process reputation is greater than 85 (Most Likely Trusted), ATP stops traversing the process tree, leaving the ancestor processes running. If the reputation is less than 85, ATP skips the critical process, but stops the ancestor processes.
Excluded in the Threat Prevention On-Access Scan → Standard exclusions settings.
ATP doesn't stop excluded processes, but does stop the process' ancestors.
If enhanced remediation is enabled, ATP rolls back changes that the process made to the system.
ATP then stops the convicted process if it has a reputation of 50 or lower.
To prevent threats from persisting, ATP removes references to the convicted process, its ancestors, and descendants.
Registry and file objects that ATP examines include registry keys, scheduled tasks (Windows Task Scheduler), services, shortcut files, and WMI (Windows Management Instrumentation) triggers and filters.
ATP quarantines objects that were removed from the registry associated with a convicted process so you can delete or restore them using a ePO - On-prem client task or from the Quarantine page of the Trellix Endpoint Security (ENS) Client.
Trellix ENS remediates threats differently, depending on whether the threat is a file or process (portable executable or DLL).
File remediation
If the detection is a file, the Threat Prevention on-access scanner or on-demand scanner handles the threat according to configuration settings. For example, Threat Prevention quarantines the file and you can delete or restore it.
If the file is a portable executable (PE), ATP stops all processes (descendants and ancestors) associated with the PE file.
If the PE file is a DLL, ATP also locates all processes that loaded the DLL and tries to eject the DLL from those processes. If the ejection is unsuccessful, ATP stops the processes, descendants, and ancestors.
Process remediation
ATP stops the process, its descendants, and ancestors.