Ransomware Protection prevents the unauthorized modification or encryption of files on OfficeScan agents by "ransomware" threats. Ransomware is a type of malware which restricts access to files and demands payment to restore the affected files.
You can configure Behavior Monitoring to detect a specific sequence of events that may indicate a ransomware attack. After Behavior Monitoring matches all of the following criteria, OfficeScan terminates and quarantines the offending program:
A process not recognized as safe attempts to modify, delete, or rename three files within a certain time interval.
The process attempted to modify a protected file extension type
OfficeScan cannot recover the first files affected by the ransomware process.
To reduce the chance of OfficeScan detecting a safe process as malicious, ensure that the OfficeScan agent has Internet access to perform additional verification processes using Trend Micro servers.