About these release notes

These are the release notes for Intercept X Advanced for Server with EDR for Windows Server 2008 R2 and later operating systems.

Some of the features mentioned in these release notes are only available if you have the appropriate license.Note

You may find that you cannot yet download and use the latest version. This is because Sophos releases the software over a number of days, but publishes the release notes on the first day.

You should also read the Sophos Server Core Agent release notes. They cover the changes, resolved issues and known issues for the core components.

For information about the changes to the Sophos Server Core Agent, see the Sophos Server Core Agent release notes.

For information about the changes to Sophos Central Server Anti-Virus, see the Sophos Central Server Anti-Virus release notes.

For improvements and new features in the Sophos Central console, see What’s new in Sophos Central.

Updates that require a restart

Occasionally an update requires a restart. Sophos never forces this restart and there is no impact on protection or threat detection updates during the period before the restart.

We recommend that you schedule a restart during your next maintenance window to ensure that you are running the latest version.Versions

Components

Version 2.0.16

Updated Components

HitManPro.Alert has been updated to 3.7.15.446.

New features

This release supports the following new protection features. These will initially be turned on only for servers in early access program subscriptions, before being turned on for all Intercept X customers:

• API Set Guard
• CTF Guard
• CryptoGuard – EFS
• Dynamic Shellcode

Resolved issues

Version 2.0.11

What’s new

This version includes improvements and fixes to HitManPro.Alert.

Updated Components

HitManPro.Alert has been updated to 3.7.14.40.

Resolved issues

Version 2.0.8

What’s new

This version includes improvements and fixes to HitManPro.Alert.

Updated Components

HitManPro.Alert has been updated to 3.7.12.466.466.

Machine Learning Model has been updated to 20190222.

Version 2.0.5

What’s new

This version includes improvements and fixes to HitManPro.Alert.

Updated Components

HitManPro.Alert has been updated to 3.7.10.762.174.

Machine Learning Model has been updated to 20181024.

Resolved issues

Version 2.0.4

Updated Components

Machine Learning Model has been updated to 20180820.

Version 2.0.3

What’s new

This version includes security improvements.

Version 2.0.2

What’s new

This version includes security improvements.

Updated Components

HitManPro.Alert has been updated to 3.7.7.755.40.

Machine Learning Model has been updated to 20180611.

Version 2.0.1

What’s new

Deep learning

Deep learning uses advanced machine learning to detect threats. It can identify known and previously unknown malware and potentially unwanted applications without using signatures.

Deep learning quarantines detected items, together with associated registry entries, links or files. If you’re sure that an item is safe, you can restore it and stop deep learning from detecting it again.

Exploit prevention features

We now protect against these exploits:

Credential theft. We prevent the theft of passwords and hash information from memory, registry, or hard disk.

Code cave exploits. We detect malicious code that’s been inserted into another, legitimate application.

Privilege escalation. We prevent attacks from escalating a low-privilege process to higher privileges to access your systems.

Malicious process migration. We prevent attacks from moving across to a system process that’s hard to close down.

APC abuse. We prevent attacks from using Application Procedure Calls (APC) to run their code.

This release also includes:

Application lockdown. We prevent browsers from using Power Shell and running applications.

New registry protection. We prevent attacks that exploit the Windows “sticky keys” feature or the application verifier in order to run unauthorized software at startup.

Known issues and limitations

See https://community.sophos.com/kb/en-us/124988 for a full list of known issues with Sophos Central Server Intercept X .

Additional information

System requirements

This version of Sophos Central Server Intercept X is supported on Windows Server 2008 R2 and later operating systems. Versions of Windows targeted by Microsoft for non-business environments are not supported.

Support

You can find technical support for Sophos products in any of these ways:

• Visit the Sophos Community at community.sophos.com/ and search for other users who are experiencing the same problem.
• Visit the Sophos support knowledge base at www.sophos.com/en-us/support.aspx.
• Download the product documentation at www.sophos.com/en-us/support/documentation.aspx.
• Open a ticket with our support team at https://secure2.sophos.com/support/contact-support/support-query.aspx.

Legal notices

Copyright © 2020 Sophos Limited. All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording or otherwise unless you are either a valid licensee where the documentation can be reproduced in accordance with the license terms or you otherwise have the prior permission in writing of the copyright owner.

Sophos and Sophos Anti-Virus are registered trademarks of Sophos Limited and Sophos Group. All other product and company names mentioned are trademarks or registered trademarks of their respective owners.