New Update Trend Micro new pattern release

[Zartarra]

Trend Micro new signature files drops alot of signature with a total of 425. I have never seen such a high drop in signatures. I hope they can capture all the threats with their other modules.

 

[Jonny Quest]

Is that from within the app, log files, or it looks like from a webpage? I'm running a trial of IS, and found the Component update list (there were 2 today), but if you could point me in the right direction, I would appreciate it

 

[Zartarra]

I check there FTP site at: https://www.trendmicro.com/ftp/prod..._scan_pattern/whatsnew_Smart_Scan_Pattern.txt.

The files and versionnumbers can also be found at Download Center | Trend Micro.

 

[Jonny Quest]

Thank you

 

[Trident]

I've seen that many times.

 

[Sorrento]

Trident has mentioned that before as I remember...

 

[Shadowra]

Isn't that just cleaning up old threats that are no longer circulating?

And besides, Trend has an excellent Behavior Blocker

 

[Trident]

Isn't that just cleaning up old threats that are no longer circulating?

And besides, Trend has an excellent Behavior Blocker

Not always old, sometimes they create these detections only to clean them a week later. I think over time another detection or heuristic covers them and they are just redundant. Trend Micro is NGAV/Hybrid, they do not use definitions the way Bitdefender and others use them.

 

[Jonny Quest]

Isn't that just cleaning up old threats that are no longer circulating?

And besides, Trend has an excellent Behavior Blocker

I just kinda skimmed through your TM review and your conclusions before I installed the trial, so this post is good to know, is reassuring

 

[stonjean633]

This is normal. Any signatures that are a threat in the past but not at present gets drop.

 

[Trident]

The local database from which these detections are dropped doesn’t contain signatures—Trend Micro is signatureless. As it can be noted from the same suffix many detections have got (such as USBLJ225), these are heuristic-based detections. Over time newer and more efficient heuristics are added to the product. For Trend Micro it is imperative that this database is kept small.

In addition to this database, Trend Micro uses the following:

• Heuristics specially to deal with packers
• Aggressive heuristics activated in Hypersensitive mode
• New File Warning
• Cloud-based AI (static analysis) (executed on low prevalence files)
• Cloud-based AI (dynamic analysis) (executed on low prevalence files)
• Server-side database (stores hashes and metadata)
• Behavioural blocking and policy enforcement (several patterns related to it) (AI used on low prevalence processes)
• Aggressive correlational and cleanup heuristics on detected threats
• Anti-Botnet feature
• Anti-Ransomware (folder shield)

 

[Jonny Quest]

The local database from which these detections are dropped doesn’t contain signatures—Trend Micro is signatureless. As it can be noted from the same suffix many detections have got (such as USBLJ225), these are heuristic-based detections. Over time newer and more efficient heuristics are added to the product. For Trend Micro it is imperative that this database is kept small.

In addition to this database, Trend Micro uses the following:

• Heuristics specially to deal with packers
• Aggressive heuristics activated in Hypersensitive mode
• New File Warning
• Cloud-based AI (static analysis) (executed on low prevalence files)
• Cloud-based AI (dynamic analysis) (executed on low prevalence files)
• Server-side database (stores hashes and metadata)
• Behavioural blocking and policy enforcement (several patterns related to it) (AI used on low prevalence processes)
• Aggressive correlational and cleanup heuristics on detected threats
• Anti-Botnet feature
• Anti-Ransomware (folder shield)

Amazing, bookmarked for future reference

 

[Trident]

These are some components. Not all of them are included in TM for home, there are 2-3 that aren’t and there are some which are not listed in this table.

Component	Description
Virus Pattern	A file that helps the Agents identify virus signatures, unique patterns of bits and bytes that signal the presence of a virus.
Virus Pattern (Android)	A file that helps the Agents identify virus signatures, unique patterns of bits and bytes that signal the presence of a virus on Android devices.
Virus Scan Engine (32-bit/64-bit on Windows and 32-bit on Mac OS X)	The scan engine uses the virus pattern file to detect virus/malware and other security risks on files that your users are opening and/or saving. The scan engine works together with the virus pattern file to perform the first level of detection, using a process called pattern matching. Since each virus contains a unique "signature" or string of tell-tale characters that distinguish it from any other code, the virus experts at Trend Micro capture inert snippets of this code in the pattern file. The engine then compares certain parts of each scanned file to patterns in the virus pattern file, searching for a match.
Damage Cleanup Template	The Damage Cleanup Template is used by the Damage Cleanup Engine to identify Trojan files and processes so the engine can eliminate them.
Damage Cleanup Engine 32/64-bit	The Damage Cleanup Engine scans for and removes Trojans and Trojan processes.
IntelliTrap Exception Pattern	The IntelliTrap Exception Pattern contains a list of "approved" compression files.
IntelliTrap Pattern	The IntelliTrap Pattern detects real-time compression files packed as executable files.
Smart Feedback Engine (32-bit/64-bit)	The engine for sending feedback to the Trend Micro Smart Protection Network.
Smart Scan Agent Pattern	The pattern file that the Security Agent uses to identify threats. This pattern file is stored on the endpoint that runs the Security Agent.
Early Boot Cleanup Driver 32/64-bit	The Trend Micro Early Boot Cleanup Driver loads before the operating system drivers which enables the detection and blocking of boot-type rootkits. After the Security Agent loads, Trend Micro Early Boot Cleanup Driver calls Damage Cleanup Services to clean the rootkit.
Memory Inspection Pattern	Real-Time Scan uses this pattern file to evaluate executable compressed files identified by Behavior Monitoring.
Contextual Intelligence Engine 32/64-bit	The Contextual Intelligence Engine monitors processes executed by low prevalence files and extracts behavioral features that the Contextual Intelligence Query Handler sends to the Predictive Machine Learning engine for analysis.
Contextual Intelligence Pattern	The Contextual Intelligence Pattern contains a list of "approved" behaviors that are not relevant to any known threats.
Contextual Intelligence Query Handler 32/64-bit	The Contextual Intelligence Query Handler processes the behaviors identified by the Contextual Intelligence Engine and sends the report to the Predictive Machine Learning engine.
Advanced Threat Scan Engine 32/64-bit	The Advanced Threat Scan Engine extracts file features from low prevalence files and sends the the information to the Predictive Machine Learning engine.
Advanced Threat Correlation Pattern	The Advanced Threat Correlation Pattern contains a list of file features that are not relevant to any known threats.
MARS Pattern for Android	A file that the Security Agent on Android endpoints uses in conjuction with cloud-based Trend Micro Mobile Apps Reputation Service (MARS) to identify mobile threats based on app behaviors. Trend Micro MARS uses leading sandbox and machine learning technologies to protect users against malware, privacy leaks, and app vulnerabilities.

Anti-Spyware​

Component	Description
Spyware/Grayware Scan Engine v. 6 (32-bit)	A separate scan engine that scans for, detects, and removes spyware/grayware from infected computers and servers running on i386 (32-bit) operating systems.
Spyware/Grayware Scan Engine v.6 (64-bit)	Similar to the spyware/grayware scan engine for 32-bit systems, this scan engine scans for, detects, and removes spyware on x64 (64-bit) operating systems.
Spyware/Grayware Pattern v.6	Contains known spyware signatures and is used by the spyware scan engines (both 32-bit and 64-bit) to detect spyware/grayware on devices for Manual and Scheduled Scans.
Spyware/Grayware Pattern	Contains known spyware signatures and is used by the spyware scan engines (both 32-bit and 64-bit) to detect spyware/grayware on devices for Manual and Scheduled Scans.

URL Filtering​

Component	Description
URL Filtering Engine (32-bit/64-bit)	The engine that queries the Trend Micro Security database to evaluate the page.

Behavior Monitoring​

Component	Description
Behavior Monitoring Core Driver 32/64-bit	This driver detects process behavior on clients.
Behavior Monitoring Core Service 32/64-bit	Agents uses this service to handle the Behavior Monitor Core Drivers.
Policy Enforcement Pattern	The list of policies configured on the Worry-Free ServicesConsole that must be enforced by Agents.
Digital Signature Pattern	List of Trend Micro-accepted companies whose software is safe to use.
Behavior Monitoring Configuration Pattern	The Behavior Monitoring Driver uses this pattern to identify normal system events and exclude them from policy enforcement.
Behavior Monitoring Detection Pattern 32/64-bit	This pattern contains the rules for detecting suspicious threat behavior.
Memory Scan Trigger Pattern (32/64-bit)	This pattern contains the rules for detecting suspicious threat behavior.
Program Inspection Engine 32/64-bit	The Program Inspection Engine passes user mode events to the Behavior Monitoring Core Service in asynchronous (ASYNC) mode.
Program Inspection Monitoring Pattern	The Program Inspection Monitoring Pattern monitors and stores inspection points that are used for Behavior Monitoring.
Damage Recovery Engine 32/64-bit	The Damage Recovery Engine receives system events and backup files before suspicious threats can modify files and perform other malicious behavior. This engine also restores the affected files after it receives a file recovery request.
Damage Recovery Pattern	The Damage Recovery Pattern contains policies that are used for monitoring suspicious threat behavior.

Data Loss Prevention​

Component	Description
Data Protection Application Pattern	The Data Protection Application Pattern contains policies that Data Loss Prevention uses in Chrome.

Aggressive Scan​

Component	Description
Smart Scan Aggressive Pattern	The pattern file that Aggressive Scan uses to identify threats. This pattern file is stored on the endpoint that runs the Security Agent.
Program Inspection Pattern	The pattern file that Aggressive Scan uses to identify fake antivirus (FAKEAV) threats.

Network Virus​

Component	Description
Common Firewall Pattern	Like the Virus Pattern, the Common Firewall Pattern helps agents identify virus signatures, unique patterns of bits and bytes that signal the presence of a network virus.
Common Firewall Driver 32/64-bit	The Firewall Driver, in conjunction with the user-defined settings of the firewall, blocks ports during an outbreak.

Browser Exploits​

Component	Description
Browser Exploit Prevention Pattern	This pattern identifies the latest web browser exploits and prevents the exploits from being used to compromise the web browser.
Script Analyzer Unified Pattern	This pattern analyzes script in web pages and identifies malicious script.

 

[stonjean633]

These are some components. Not all of them are included in TM for home, there are 2-3 that aren’t and there are some which are not listed in this table.

Component	Description
Virus Pattern	A file that helps the Agents identify virus signatures, unique patterns of bits and bytes that signal the presence of a virus.
Virus Pattern (Android)	A file that helps the Agents identify virus signatures, unique patterns of bits and bytes that signal the presence of a virus on Android devices.
Virus Scan Engine (32-bit/64-bit on Windows and 32-bit on Mac OS X)	The scan engine uses the virus pattern file to detect virus/malware and other security risks on files that your users are opening and/or saving. The scan engine works together with the virus pattern file to perform the first level of detection, using a process called pattern matching. Since each virus contains a unique "signature" or string of tell-tale characters that distinguish it from any other code, the virus experts at Trend Micro capture inert snippets of this code in the pattern file. The engine then compares certain parts of each scanned file to patterns in the virus pattern file, searching for a match.
Damage Cleanup Template	The Damage Cleanup Template is used by the Damage Cleanup Engine to identify Trojan files and processes so the engine can eliminate them.
Damage Cleanup Engine 32/64-bit	The Damage Cleanup Engine scans for and removes Trojans and Trojan processes.
IntelliTrap Exception Pattern	The IntelliTrap Exception Pattern contains a list of "approved" compression files.
IntelliTrap Pattern	The IntelliTrap Pattern detects real-time compression files packed as executable files.
Smart Feedback Engine (32-bit/64-bit)	The engine for sending feedback to the Trend Micro Smart Protection Network.
Smart Scan Agent Pattern	The pattern file that the Security Agent uses to identify threats. This pattern file is stored on the endpoint that runs the Security Agent.
Early Boot Cleanup Driver 32/64-bit	The Trend Micro Early Boot Cleanup Driver loads before the operating system drivers which enables the detection and blocking of boot-type rootkits. After the Security Agent loads, Trend Micro Early Boot Cleanup Driver calls Damage Cleanup Services to clean the rootkit.
Memory Inspection Pattern	Real-Time Scan uses this pattern file to evaluate executable compressed files identified by Behavior Monitoring.
Contextual Intelligence Engine 32/64-bit	The Contextual Intelligence Engine monitors processes executed by low prevalence files and extracts behavioral features that the Contextual Intelligence Query Handler sends to the Predictive Machine Learning engine for analysis.
Contextual Intelligence Pattern	The Contextual Intelligence Pattern contains a list of "approved" behaviors that are not relevant to any known threats.
Contextual Intelligence Query Handler 32/64-bit	The Contextual Intelligence Query Handler processes the behaviors identified by the Contextual Intelligence Engine and sends the report to the Predictive Machine Learning engine.
Advanced Threat Scan Engine 32/64-bit	The Advanced Threat Scan Engine extracts file features from low prevalence files and sends the the information to the Predictive Machine Learning engine.
Advanced Threat Correlation Pattern	The Advanced Threat Correlation Pattern contains a list of file features that are not relevant to any known threats.
MARS Pattern for Android	A file that the Security Agent on Android endpoints uses in conjuction with cloud-based Trend Micro Mobile Apps Reputation Service (MARS) to identify mobile threats based on app behaviors. Trend Micro MARS uses leading sandbox and machine learning technologies to protect users against malware, privacy leaks, and app vulnerabilities.

Anti-Spyware​

Component	Description
Spyware/Grayware Scan Engine v. 6 (32-bit)	A separate scan engine that scans for, detects, and removes spyware/grayware from infected computers and servers running on i386 (32-bit) operating systems.
Spyware/Grayware Scan Engine v.6 (64-bit)	Similar to the spyware/grayware scan engine for 32-bit systems, this scan engine scans for, detects, and removes spyware on x64 (64-bit) operating systems.
Spyware/Grayware Pattern v.6	Contains known spyware signatures and is used by the spyware scan engines (both 32-bit and 64-bit) to detect spyware/grayware on devices for Manual and Scheduled Scans.
Spyware/Grayware Pattern	Contains known spyware signatures and is used by the spyware scan engines (both 32-bit and 64-bit) to detect spyware/grayware on devices for Manual and Scheduled Scans.

URL Filtering​

Component	Description
URL Filtering Engine (32-bit/64-bit)	The engine that queries the Trend Micro Security database to evaluate the page.

Behavior Monitoring​

Component	Description
Behavior Monitoring Core Driver 32/64-bit	This driver detects process behavior on clients.
Behavior Monitoring Core Service 32/64-bit	Agents uses this service to handle the Behavior Monitor Core Drivers.
Policy Enforcement Pattern	The list of policies configured on the Worry-Free ServicesConsole that must be enforced by Agents.
Digital Signature Pattern	List of Trend Micro-accepted companies whose software is safe to use.
Behavior Monitoring Configuration Pattern	The Behavior Monitoring Driver uses this pattern to identify normal system events and exclude them from policy enforcement.
Behavior Monitoring Detection Pattern 32/64-bit	This pattern contains the rules for detecting suspicious threat behavior.
Memory Scan Trigger Pattern (32/64-bit)	This pattern contains the rules for detecting suspicious threat behavior.
Program Inspection Engine 32/64-bit	The Program Inspection Engine passes user mode events to the Behavior Monitoring Core Service in asynchronous (ASYNC) mode.
Program Inspection Monitoring Pattern	The Program Inspection Monitoring Pattern monitors and stores inspection points that are used for Behavior Monitoring.
Damage Recovery Engine 32/64-bit	The Damage Recovery Engine receives system events and backup files before suspicious threats can modify files and perform other malicious behavior. This engine also restores the affected files after it receives a file recovery request.
Damage Recovery Pattern	The Damage Recovery Pattern contains policies that are used for monitoring suspicious threat behavior.

Data Loss Prevention​

Component	Description
Data Protection Application Pattern	The Data Protection Application Pattern contains policies that Data Loss Prevention uses in Chrome.

Aggressive Scan​

Component	Description
Smart Scan Aggressive Pattern	The pattern file that Aggressive Scan uses to identify threats. This pattern file is stored on the endpoint that runs the Security Agent.
Program Inspection Pattern	The pattern file that Aggressive Scan uses to identify fake antivirus (FAKEAV) threats.

Network Virus​

Component	Description
Common Firewall Pattern	Like the Virus Pattern, the Common Firewall Pattern helps agents identify virus signatures, unique patterns of bits and bytes that signal the presence of a network virus.
Common Firewall Driver 32/64-bit	The Firewall Driver, in conjunction with the user-defined settings of the firewall, blocks ports during an outbreak.

Browser Exploits​

Component	Description
Browser Exploit Prevention Pattern	This pattern identifies the latest web browser exploits and prevents the exploits from being used to compromise the web browser.
Script Analyzer Unified Pattern	This pattern analyzes script in web pages and identifies malicious script.

Right!
VSAPI and ATSE are the core of Trend Security Suites.