Trellix – Malware Analysis

Trellix Malware Analysis, the former FireEye AX series, is a forensic analysis appliance that gives security analysts hands-on control over preconfigured test environments for executing and inspecting malware. It runs the Trellix Intelligent Virtual Execution engine to detonate suspicious web objects, email attachments and files in instrumented Windows, macOS and Linux virtual machines, and it reports on changes to file systems, memory and registries along with outbound connection attempts across multiple protocols. Analysts choose between a sandbox mode, where an execution path is fully contained, and a live mode that allows external connectivity so multi-stage attacks can be followed through callbacks and follow-on downloads. Files can be analyzed singly or in batches, and customers can import custom YARA-based rules for threats specific to their organization. Anonymized attack profiles can be shared through the Trellix Central Management System and Dynamic Threat Intelligence to support blocking elsewhere in a Trellix deployment. The AX 5600 model is rated by Trellix for up to 10,000 analyses per day. The product is aimed at incident response teams and threat researchers who need to reverse engineer targeted attacks without building and resetting their own analysis labs. Trellix also sells a separate Intelligent Sandbox and IVX-based options, so buyers should confirm which product fits their deployment.