Test Sophos Intercept X file encryption

Hi andra2 

We strongly recommend you to test the features in the testing environments, please refer this thread from where you can find few samples. Also, for the new features introduced in intercept X which you can test using the Sophos Test tool, kindly take a look into this article. 

Hi there,
Thanks for the information.
I have now encrypted a PDF file with the AxCrypt tool on a Windows test server 2016.
This would be possible without major problems! The file has been completely encrypted!
I thought Intercept X would prohibit this during the encryption process?
Or am I wrong here?

greetings

Hi andra2 

Intercept X will not detect the encryption process where a single file is being encrypted. Intercept X will detect the process which is trying to encrypt the multiple files within a few seconds and if the process is not whitelisted for Intercept X like encryption product vendors.

Hi,

is there an overview of the white list?

regards

Hi andra2 

The applications which are encryption solutions should not be detected for the ransomware detection through Intercept X in this process.

Hi Jasmin,

then there is no way to test Intercept X on a test server, right?

Regards

Hi andra2 

You can contact your partner or Sophos account manager who can help you to test the functionalities of Intercept X.

Hello andra2,

not with the cloud Intercept X but the on-premise EXP and not with local encryption I made a simplistic test for protection from remote ransomware. Accessed the share from a workstation, took a bunch of files, encrypted them, and wrote them back (simply Explorer copy) in one go. Didn't get far, connection was cut after three or four files, when I checked on the server they had already been restored.

Christian

Hello andra2,

not with the cloud Intercept X but the on-premise EXP and not with local encryption I made a simplistic test for protection from remote ransomware. Accessed the share from a workstation, took a bunch of files, encrypted them, and wrote them back (simply Explorer copy) in one go. Didn't get far, connection was cut after three or four files, when I checked on the server they had already been restored.

Christian

Thank you for the info, I will test it sometimes.