Malware Behavior Blocking provides a necessary layer of additional threat protection from programs that exhibit malicious behavior. It observes system events over a period of time. As programs execute different combinations or sequences of actions, Malware Behavior Blocking detects known malicious behavior and blocks the associated programs. Use this feature to ensure a higher level of protection against new, unknown, and emerging threats.

Behavior Monitoring can detect malicious scripts executed by legitimate Windows programs and the true payload path of script files executed by legitimate DLLs to protect endpoints against malware hidden in fileless attack vectors.

Malware Behavior Monitoring provides the following threat-level scanning options:

After blocking a program with notifications enabled, the Security Agent displays a notification on the endpoint.

For details about notifications, see Behavior Monitoring Notifications for Security Agent Users.