A security engineer is configuring a new Exploit Prevention profile in XSIAM. The requirement is to ensure that attempts to inject code into legitimate processes (DLL injection) are blocked and logged. Which section of the profile configuration controls memory protection techniques?
Trap 1: Disk Encryption > Policy Rules
Disk Encryption policy rules govern full-disk encryption compliance and key management, so they cannot block or log DLL injection into running processes. Disk encryption configuration would be the correct section when the requirement concerns protecting data at rest on endpoints.
Trap 2: Malware > Behavioral Threat Protection
Behavioral Threat Protection under Malware analyses process behaviour for malicious activity, but it does not configure the memory-protection techniques that block DLL injection. It would be the right section when the requirement is behavioural malware detection rather than exploit memory protection.
Trap 3: Exploit Prevention > Malware Protection Rules
Malware Protection Rules within Exploit Prevention target malicious file behaviour and known malware execution, not memory-protection techniques such as DLL injection blocking. This section would be correct when the requirement is to detect and block malicious executables or payloads.
- A
Exploit Prevention > Mitigation settings / Process protections
DLL injection into legitimate processes is a memory-protection attack, so mitigation settings under Process protections control it. This section enforces anti-injection safeguards such as blocking remote thread creation and unauthorised module loading, satisfying the requirement to block and log injection attempts.
- B
Disk Encryption > Policy Rules
Why it fails: Disk Encryption policy rules govern full-disk encryption compliance and key management, so they cannot block or log DLL injection into running processes. Disk encryption configuration would be the correct section when the requirement concerns protecting data at rest on endpoints.
- C
Malware > Behavioral Threat Protection
Why it fails: Behavioral Threat Protection under Malware analyses process behaviour for malicious activity, but it does not configure the memory-protection techniques that block DLL injection. It would be the right section when the requirement is behavioural malware detection rather than exploit memory protection.
- D
Exploit Prevention > Malware Protection Rules
Why it fails: Malware Protection Rules within Exploit Prevention target malicious file behaviour and known malware execution, not memory-protection techniques such as DLL injection blocking. This section would be correct when the requirement is to detect and block malicious executables or payloads.