The Behavioral Guard & Anti-Ransomware Component

Behavioral Guard constantly monitors files and network activity for suspicious behavior.

The Anti-Ransomware creates honeypot files on client computers, and stops the attack immediately after it detects that the ransomware modified the files.

For E88.50 and later

Starting from version E88.50 and later, the Anti-Ransomware creates the honeypot files in these folders:

• Drive root (C:\ , D:\ , Etc)

• C:\Users\Public\Music

• C:\Users\<User>\Music (MyMusic)

• C:\Users\Public\Documents

• C:\Users\<User>\Documents (MyDocuments)

• C:\Users\Public\Videos

• C:\Users\<User>\Videos (MyVideos)

• C:\Users\Public\Pictures

• C:\Users\<User>\Pictures (MyPictures)

• C:\Program Files (x86)

• C:\ProgramData

• C:\Users\<User>\AppData\Roaming

• C:\Users\<User>\AppData\Local

For versions prior to E88.50

For versions prior to E88.50, the Anti-Ransomware creates the honeypot files in these folders:

• C:\Users\Public\Music

• C:\Users\<User>\Music (MyMusic)

• C:\Users\Public\Documents

• C:\Users\<User>\Documents (MyDocuments)

• C:\Users\Public\Videos

• C:\Users\<User>\Videos (MyVideos)

• C:\Users\Public\Pictures

• C:\Users\<User>\Pictures (MyPictures)

• C:\Program Files (x86)

• C:\ProgramData

• C:\Users\<User>\AppData\Roaming

• C:\Users\<User>\AppData\Local

For E88.41 and later

Starting with version E88.41 and later, folders with restricted access are identified by a lock icon next to the folder name.

For example:

For versions prior to E88.41

For versions prior to E88.41, folders with restricted access are identified by a lock icon next to the folder name.

For example:

The file names include these strings, or similar:

• CP

• CheckPoint

• Check Point

• Check-Point

• Sandblast Agent

• Sandblast Zero-Day

• Endpoint

Before ransomware attack can encrypt files, Anti-Ransomware backs up your files to a safe location. After the attack is stopped, it deletes files involved in the attack and restores the original files from the backup location.

• Prevent - The attack is remediated. Logs, alerts and a forensic report are created.

• Detect - Logs, alerts and a forensic report are created.

• Off - Nothing is done on the detection, a log is not created

Advanced Behavioral Guard & Anti-Ransomware Settings

• Enable network share protection - Enables the protection of shared folders on the network. All shared folders are protected, regardless of the protocol. Remote devices are not protected.

• Block Volume Encryption tools (BitLocker and Similar Tools): As many ransomwares use volume encryption software, such as BitLocker to encrypt drives.

  Note:

  This feature is supported with the Endpoint Security Client version E86.30 with the default client mode as Detect. With the Endpoint Security Client version E86.50 and higher, the default client mode is Prevent.

  You can block such programs from:

  • Encrypting unencrypted drives

  • Modifying the encryption of encrypted drives (such as changing password)

  If you want to encrypt your drive with BitLocker or a similar software:

  • Encrypt the drive before you install the Endpoint Security Client, or

  • Disable this protection, encrypt and resume this protection

• Low memory mode:

  This setting reduces memory usage by loading a carefully selected subset of threat signatures, optimized for protection effectiveness and minimal memory footprint. While this can help improve performance on devices with limited memory, it may slightly reduce detection coverage in some scenarios.

  Check Point recommends to enable this mode only on systems with low memory capacity, where resource constraints justify the trade-off.

  Note:

  The Low memory mode setting is supported starting with Endpoint Security Client version E87.30 and above.

Backup Settings

When Anti-Ransomware is enabled, it constantly monitors files and processes for unusual activity. Before a ransomware attack can encrypt files,Anti-Ransomware backs up your files to a safe location. After the attack is stopped, it deletes files involved in the attack and restores the original files from the backup location.

• Restore to selected location - By default, files are restored to their original location. To restore files to a different location, select this option and enter the location to which you want to restore the files in the Choose location field. Each time files are automatically restored, they will be put in the selected location.

• Anti-Ransomware maximum backup size on disk - Set the maximum amount of storage for Anti-Ransomware backups. The default value is 1 GB.

• Backup time interval - Within this time interval, each file is only backed up one time, even if it is changed multiple times. The default value is 60 minutes.

• Backup Settings - Change default types to be backed up - Click this to see a list of file types that are included in the Anti-Ransomware backup files. You can add or remove file types from the list and change the Maximum Size of files that are backed up.

  Notes: By default, the maximum file size for back up is 25 MB. To change the maximum file size, edit the Maximum Size (MB). For information on the Endpoint Security folder, see sk147454.

• Disk Usage - By default, Forensics uses up to 1 GB of disk space on the client computer for data.