Sophos Limited

Daniel Montaque Teal

Andrew James Thomas

Steven John Braggs

A computer-implemented method includes identifying one or more software processes that execute on the endpoint device and that perform at least one file operation including opening a file, reading the file, writing the file, or transmitting the file over a network. The method further includes storing for each software process of the one or more software processes identification information about the file. The method further includes responsive to determining that a triggering event has occurred, performing one or more actions including: preventing deletion of the file, determining one or more attributes of a suspicious process that accessed the file, requesting that a separate component analyze event journal records in relation to a time interval that overlaps with when the suspicious process accessed the file, or transmitting a cryptographic hash of the file to a server.

Growing community of inventors

Austin, TX, United States of America

Daniel Montaque Teal