Next-Gen Antivirus (Windows)

In this article, you will learn everything you need to know about the Next-Gen Antivirus module.

1. Description
2. How does Next-Gen Antivirus work?
3. Heimdal Agent - Next-Gen Antivirus
4. Next-Gen Antivirus view
5. Next-Gen Antivirus settings

DESCRIPTION

Next-Gen Antivirus is the reactive protection side of our product suite. The Next-Gen Antivirus solution reacts to infected files found on the system. Next-Gen Antivirus combines the techniques of both traditional and next-generation antivirus to detect and remediate viruses, APTs, financial fraud, ransomware, and data leaks. It complements the DNS Security - Endpoint module to offer all-around protection. It offers a centralized management interface across all devices for easy corporate client management. It is flexible and easy to use, and it offers a wide variety of scanning profiles to fit your corporate needs. The addition of the XTP engine supercharges Next-Gen Antivirus with Extended Threat Protection (XTP) capabilities, supplying you with evidence-based information about sophisticated cybersecurity risks, offering a holistic view of weaknesses categorized by MITRE ATT&CK tactics and techniques and, ultimately, providing state-of-the-art protection. The new version of Heimdal's Next-Gen Antivirus offers more Windows OS native capabilities, as well as the XTP engine with its aforementioned benefits.

HOW DOES NEXT-GEN ANTIVIRUS WORK?

As a standalone antivirus product, Next-Gen Antivirus features a complex threat scan module that is capable of detecting viruses, trojans, riskware, heuristic threats, adware, backdoors, constructors, dialers, exploits, trash, and APCs. Besides the scan module available in each Heimdal Agent installation, the antivirus solution also includes a reporting and control dashboard, a protection cloud, a local quarantine location, and VDFs (Virus Definition Files).

HEIMDAL AGENT - NEXT-GEN ANTIVIRUS

Endpoint Detection - Next-Gen Antivirus (inside the Heimdal Agent) allows the end user to run or stop a scan (if allowed in the Group Policy settings), and it also displays information about the detected Infections and the Quarantined files.

An end user who is allowed to start a scan can click the Go To Scan button, where they can select one of the following scan types:

• Quick Scan - scans critical OS locations and the most common target folders known for virus activity:
  C:\Windows\system32, C:\Windows\SysWOW64, C:\Program Files\Common Files, C:\Program Files (x86)\Common Files, C:\Windows.
• Active Processes Scan - scans all the processes currently running on the machine.
• Full Scan - scans all the local files on the computer.
• Hard Drive Scan - scans all files on the hard drive while ignoring the files on all external media types.
• Local Drive Scan - scans all local disks, including hard drives, optical drives, and external storage.
• Removable Drive Scan - scans the files on flash, optical, or external drives.
• System Scan - scans the system directory.
• Network Drive Scan - scans mapped network drives (does not work with network locations). The Heimdal Agent detects infected files, but no action (Quarantine/Delete) is performed because a file located on a network cannot be moved to the local quarantine folder.

The Heimdal Agent displays the scheduled scans configured in the Group Policy:There is also an option to scan individual files/folders using the Scan with Next-Gen Antivirus option, available by right-clicking the selected file/folder. This scan type is limited to 15 selected files/folders at a time.
The Infected/Quarantined view displays a list of intercepted Files, the Threat Category, Infection Name, and Date.

NEXT-GEN ANTIVIRUS VIEW

The Endpoint Detection - Next-Gen Antivirus view displays all the information collected by the Heimdal Agent running on the endpoints in your organization. The collected information refers to the detected/quarantined files intercepted by the Heimdal Agent's Next-Gen Antivirus engine. At the top, you see statistics for the number of Infected Files, the number of Suspicious Files, and the number of Quarantined Files.

The collected information is organized in the following views: Latest Infections, Infections Type, Hostname/Infections, Quarantine, Exclude, Scan History, and Zero-Trust Execution Protection.

• Latest Infections
  Displays a table with the latest detected infections and the following details: Hostname, Username, File, MD5, Threat Category, Infection name, Status, Resolution, and Timestamp. You can select one or multiple infected files and add them to quarantine, delete them, or add them to storage.
  
• Infections Type
  Displays a table with the infection types and the following details: Threat Category, Number of Matches, Most Targeted Hostname, Username, and Last match.
  
• Hostname/Infections
  Displays a table with infections per hostname and the following details: Hostname, Username, Highest Threat Category, Number of Matches, and Last match.
  
• Quarantine
  Displays a table with all quarantined files and the following details: Hostname, Username, File, MD5, Threat Category, Infection Name, Status, Resolution, and Timestamp. You can select one or multiple quarantined files and remove them from quarantine or add them to storage.
  
  Quarantined files are kept for 90 days (default value).
• Exclude
  Displays a table of all exclusions and the following details: Hostname, Username, File, MD5, Threat Category, Infection Name, Status, Resolution, and Timestamp.
  
• Scan History
  Displays a table with each computer that performed scan operations (only the latest scan is displayed) and the following details: Hostname, Username, Group Policy, Timestamp, New Infections Found, and Resolution. You can select one or multiple endpoints and start a scan of a given type (Quick Scan, Full Scan, Active Processes Scan, Hard Drive Scan, Local Drive Scan, Removable Drive Scan, System Scan, Network Drive Scan). The selected scan starts on the first Group Policy check performed by the Heimdal Agent on the selected endpoint.
  
• Zero-Trust Execution Protection
  Displays a table with the processes (unsigned executable files) intercepted by the Zero-Trust Execution Protection engine and the following details: Hostname, Username, Process Name, MD5 Hash, Timestamp, and Status. Clicking the 3-dot button gives you the option to search the file hash on VirusTotal or to copy the file path to the clipboard. The detection status can be: Unknown (intercepted by ZTEP and not found in our database; files that are allowlisted globally by the Heimdal Support Team propagate to the endpoints within 3 days of being allowlisted), Allowed (intercepted by ZTEP, but allowlisted in our database or in the Exclusion list), or Blocked (intercepted by ZTEP and blocked from executing). The data in this view is updated in real time.
  
  Selecting a file from the list allows you to add it to the exclusion list or upload it to storage.

The Download CSV functionality allows you to generate and download a CSV report that includes all the information in Standard or Verbose mode for each view.
The Filters functionality allows you to filter entries by Operating System.
The files listed in the Latest Infections, Quarantine, and Exclude views can have one of the following Resolution statuses:
None - no action is taken on the file.
Deleted - the file is deleted.
DeletePending - the file has been selected for deletion, and it will be deleted when the Heimdal Agent performs a GP check.
ErrorDelete - the file has been selected for deletion, but an error occurred (the file could be in use).
ErrorQuarantine - the file has been marked to be quarantined, but an error occurred (the file could be in use).
FNOEXIST - the file has been marked to be deleted or quarantined, but it does not exist in the path (it has been removed manually or was not allowed to be written to the disk). A file that is copied/extracted/downloaded (written to the disk) is intercepted in memory before being written and is NOT allowed to be written. Next-Gen Antivirus displays an infection event, and the file is not quarantined because it is blocked in memory.
Quarantined - the file has been quarantined. A quarantined file is automatically deleted after 90 days if it has not been restored.
QuarantinePending - the file has been marked to be quarantined, and this operation will take place on the next Heimdal Agent GP check.
DeleteQuarantinePending - the file has been selected for deletion from the Quarantine list, and this operation will be performed on the next Heimdal Agent GP check.
Excluded - the file has been excluded.
ExcludePending - the file has been marked to be excluded, and the operation will take place on the next Heimdal Agent GP check.
ExcludeQuarantinePending - the file has been marked to be excluded from the Quarantine list, and the operation will take place on the next Heimdal Agent GP check.
ErrorExcludeQuarantine - the file has been marked to be excluded, and an error occurred.
ErrorRemoveQuarantine - the file has been marked to be removed from the Quarantine list, and an error occurred (the file could have been deleted manually).
RemoveExclusionPending - the file has been marked to be removed from the Exclusion list, and the operation will be performed on the next Heimdal Agent GP check.
RemoveQuarantinePending - the file has been marked to be removed from the Quarantine list, and the operation will be performed on the next Heimdal Agent GP check.

NEXT-GEN ANTIVIRUS SETTINGS

The Endpoint Detection - Next-Gen Antivirus module allows you or your users to perform scans on the endpoints in your environment to keep viruses and other threats away. Next-Gen Antivirus ensures that Microsoft Defender Antivirus, the native anti-malware solution integrated into Windows, is enabled and operating in real time. Endpoints are scanned in real time to catch both known and unknown threats: all actions performed on any file, such as reading, writing, or executing, are inspected so that malicious activity can be detected immediately.
Note: Some of the options described below are only visible when Advanced mode is enabled in the Group Policy editor.
Next-Gen Antivirus - turns the Next-Gen Antivirus module ON or OFF.

General Settings

Next-Gen Antivirus toast notification on detection - displays a brief on-screen notification on the endpoint when Next-Gen Antivirus detects a malicious file/process.
Hide Windows Defender UI - hides the Virus & threat protection tab within the Windows Security interface on the endpoints, to prevent end users from accessing it. The Heimdal Agent toast notifications are not affected.

While hidden, the Security providers section will display No providers in the Antivirus field.
Antivirus security intelligence check interval [minutes] - sets the interval Next-Gen Antivirus uses to automatically check for new virus definitions. The default value is 120 minutes, and it can be extended up to 360 minutes. When a new virus definition file (VDF) is available on the Heimdal servers, it is automatically downloaded to the local agent database. We recommend keeping the interval at 120 minutes so the database is updated as soon as possible. This option is only visible in Advanced mode.

Antivirus CPU throttling limit [percentage] - controls the maximum percentage of CPU resources (5% to 90%, in steps of 5) that Next-Gen Antivirus can use during its scans (both scheduled and on-demand), balancing robust security scanning with system performance. This option is only visible in Advanced mode.

Note: Instantaneous values will sometimes spike beyond the set limit; however, this feature brings the average CPU usage below the set value.
Isolate on tamper detection - automatically isolates the endpoint from the network if any Heimdal services are detected as being tampered with (for example, stopped by external intervention), preventing bypass attempts. Enabling this option also enables the Firewall module if it is disabled. This option is only visible in Advanced mode.
Device protection actions - enables automated defensive actions upon threat detection. A dedicated grid is displayed in which you can select one or multiple actions (Isolation, Shutdown, or Logout) for each module (Firewall, Next-Gen Antivirus, and Ransomware Encryption Protection). This option requires the Firewall module to be enabled and is only visible in Advanced mode.

IMPORTANT

If Device protection actions is enabled and the Firewall module is disabled, the latter will be enabled automatically, as will the Endpoint isolation setting (the Isolation checkboxes in the grid depend on it). If the Ransomware Encryption Protection module is disabled or not licensed, its row in the grid will be disabled (not actionable). For the Firewall module, the only available protection action is Isolation, and it is triggered after a minimum of 50 occurrences of public Brute Force Attacks. Shutdown and Logout are triggered by Next-Gen Antivirus and Ransomware Encryption Protection detections. Disabling this setting after a Group Policy update will trigger a toast message informing you that disabling Device protection actions will not disable the Firewall module or the Endpoint isolation setting.

If multiple actions are selected for a module, they are executed in order: Isolation first, followed by Shutdown, and then Logout (depending on the combination of actions, in some scenarios the Logout action will no longer be performed).

Scan Settings

Allow user to initiate a scan - enables/disables the ability of the end user to start an on-demand scan directly from the Heimdal Agent.
Allow user to cancel a scan - enables/disables the ability of the end user to cancel any running or scheduled scan directly from the Heimdal Agent.
Auto-scan USB ports - automatically scans any removable drive (flash drives, external hard drives, etc.) for threats when it is connected to the computer. On Enterprise endpoints, the scan window pops up automatically; if the Agent UI is minimized, the scan will not bring the UI to the foreground. This option is not available while Disable USB storage/media devices is enabled in USB Management.
Scan USB ports silently - hides the scan progress window on the Heimdal Agent UI when an automatic scan of a removable drive is initiated. This option works only for USB removable storage devices (not for other plug-and-play devices such as headphones, cameras, mice, or keyboards) and can be enabled only if Auto-scan USB ports is enabled.

Exclusions

This section allows you to define specific files, folders, or patterns that Next-Gen Antivirus should skip during scans and real-time protection, preventing conflicts or false positives. The Exclusion list comes with different priorities and enables you to exclude file names, file paths, directories, or patterns (wildcards). You can import a CSV list of exclusions (a sample CSV file is available from the tooltip next to the section title), search the existing entries, and export them with the Download Next-Gen AV Exclusions list .csv button. The grid lists each exclusion's Priority, File Name/Path, and Type.

Priorities
Low (former Normal Exclusions) - scans the object first and excludes it afterwards.
Medium (former Real-Time Exclusions) - excludes the object directly from the real-time driver and pre-scans it. Use this only when the Low priority doesn't work. It is recommended for applications and external drives that are used regularly and for longer periods to avoid having their files/folders blocked instantly by the Antivirus scanning.
High - excludes the object without performing any scan. A maximum of 5 high-priority exclusions is allowed; a toaster warning is displayed if you try to add more.
Note: Exclusions imported from a CSV file are added with the Medium priority by default. Change the priority, if needed, from the dropdown on each row.

Types

File Name - allows you to specify the file name that you want to exclude (e.g., test.exe, file.doc, file.txt, example.msi).
File Path - allows you to specify the full path of the file on the hard drive (e.g., C:\Users\Username\Desktop\test.exe, C:\test.exe).
Directory - allows you to specify a directory path to be excluded from scanning; sub-directories are automatically excluded (e.g., C:\Users\Username\Desktop, C:\Downloads).
Pattern - allows you to specify a pattern (e.g., C:\test\*.*, *.bat) that should be excluded from scanning. This option does not work with system variables (%USERPROFILE%, %TEMP%, etc.).

Profiles

The Profiles dropdown allows you to select one or multiple predefined exclusion profiles for known paths of specific server roles:

• Domain Controller
• Exchange Server
• File and Storage Server
• Microsoft SQL Server
• MySQL Server
• Print Server
• RDP Server

These profiles come with predefined exclusions for the folders/files associated with the server role.

Global Quarantine

The Global Quarantine list allows you to define specific files (by file path) that Next-Gen Antivirus should quarantine. Entries can be added one by one or imported from a CSV file (a sample CSV file is available from the tooltip next to the section title), and the grid lists each entry's File Name/Path and Type.

• A file added to the Global Quarantine list based on File Name can be quarantined ONLY if the Antivirus engine detects the file as Suspicious/Infected.
• A file added to the Global Quarantine list based on File Path is quarantined regardless of whether the Antivirus engine detects it as Suspicious/Infected or not.
• Files added by File Path are marked as Suspicious.
• .txt files added by File Path will not work with Real-Time Scanning.

Scan Schedule

This section allows you to schedule scans according to your preferences. Click the Add new scan button to create a scan profile.Scan Profile Name - the name of the profile you want to create.
Scan Type - the type of scan you want Heimdal Next-Gen Antivirus to run in this profile.
Description - an optional description for the profile.

• Full Scan - scans all the files on the endpoint.
• Quick Scan - scans critical OS locations and the most common target folders known for virus activity (C:\Program Files\Common Files, C:\Program Files (x86)\Common Files, C:\Windows, C:\Windows\system32, C:\Windows\SysWOW64).
• Hard Drive Scan - scans all files on the hard drive while ignoring the files on all external media types.
• Local Drive Scan - scans all local disks, including hard drives, optical drives, and external storage.
• System Scan - scans the system directory.
• Removable Drive Scan - scans files stored on flash, optical, or external drives.
• Network Drive Scan - scans files on Mapped Network Drives. It detects the infection(s), but NO action is performed because Next-Gen Antivirus cannot remove a file from a network location to place it in the local Quarantine folder. This scan type works with Mapped Network Drives but does NOT work with Network locations:
  
• Active Processes Scan - scans the processes that are currently running on the endpoint.
• Custom Scan - available only on the end user's computer in the Heimdal Agent; allows the scan of any file by using the right-click context menu and selecting Scan with Next-Gen Antivirus, which opens a new window with the result.

The scheduler lets you run the selected Scan Type in the specified timeframe. Choose one or more days of the week (Choose weekday, optionally limited to specific weeks of the month) or of the month (Choose day of month), set the Time Interval (00:00 to Midnight, minimum 2 hours), and select whether the scan is Active during time selection or Inactive during time selection. Click Set Scan to add the profile, or Cancel to discard it. Existing profiles are listed in a grid with their Name, Description, Profile Type, Type, and Interval.

The scheduler also allows you to opt for recurring schedules at the weekly level.
Choosing a day or multiple days (without selecting the weeks) will run the scan on the selected days of every week. Choosing a day or multiple days (by selecting the First Week and the Second Week) will run the scan on the selected days in the First Week and the Second Week only. The scheduler considers the way the days are distributed within the calendar.

In the example above, the month of September 2022 spans 5 weeks. The First Week starts on the 1st of September, which means that the First Week includes only 4 days, while the Fifth Week includes 5 days. Choosing a combination of Thursday and the First Week means that the scan will run on the 1st of September. Choosing a combination of Monday and the First Week means that the scan will run on the 5th of September (the first day of the Second Week), because the first Monday of the month happens then. This prevents skipping a month if the selected day is out of scope. The other case refers to a combination of Sunday and the Fifth Week, where the last Sunday is out of the scope of the Fifth Week. Because the algorithm is adjusted so as not to skip any month, the scan scheduler will run on the 25th of September (which is the actual last Sunday of the month).

IMPORTANT

The scan profile is not applied to the policy automatically after clicking Set Scan. The configured scheduler needs to be confirmed by updating the policy. If the Update GP button is not clicked, the defined scan profile will be lost if you leave the page before updating the policy. Multiple scan profiles can be created inside a Group Policy; however, the scan type is exclusive, meaning that you cannot create multiple profiles with the same scan type (for example, two full-scan profiles in the same Group Policy).

A scan started under the currently logged-in user is terminated together with that user's session if the user logs off after the scan has started. If no user is logged in, the Heimdal Agent starts the scan under the SYSTEM account, as it cannot start it under a user.

Zero-Trust Execution Protection

Zero-Trust Execution Protection reporting mode is enabled by default. We recommend leaving it on for at least 2 weeks for monitoring purposes, to allow/block patterns and exclude all the detected processes that can be considered trusted, before disabling reporting mode.

Zero-Trust Execution Protection - prevents the execution of zero-hour unsigned processes and files on the endpoints, bolstering your defense against unknown threats (it can also be enabled/disabled from the Privileges & App Control -> Privileged Access Management and Privileges & App Control -> Application Control modules). Zero-Trust Execution Protection checks unsigned executable files and blocks their execution if deemed untrusted. Note that this feature can intercept and block applications/processes that you might want to run; make sure you exclude the files/processes that you trust.
Zero-Trust Execution Protection reporting mode - detects and reports all unsigned processes and files attempting to execute on the endpoints to the Heimdal Dashboard, without actively blocking them. Note that Zero-Trust Execution reports are sent only if the status is Unknown or Blocked.
Zero-Trust Exclusions - allows you to exclude a process or a file from Zero-Trust Execution Protection by File Name, File Path, Directory, MD5, or Wildcard (e.g., C:\*\MyFolder\*.exe). You can optionally add a description (up to 500 characters), which is displayed in the grid as the Friendly name. Exclusions can be imported from a CSV file (a sample is available from the tooltip next to the section title), searched by Value or Friendly name, edited or removed from the grid, and exported with the Download Zero-Trust Exclusions list .csv button.