HitmanPro.Alert is a Sophos security program for Windows PCs that pairs the HitmanPro malware scanner with protection that runs continuously in the background. Its focus is on stopping attacks as they happen: exploits against trusted applications, ransomware encryption, credential theft and keylogging. HitmanPro.Alert is paid, with a 30-day free trial. It does not require users to remove other security software, so it can run on its own or next to an existing antivirus product. Sophos uses the same protection technology for businesses inside Sophos Intercept X.
Malware checks before programs start
The anti-malware module in HitmanPro.Alert sends a cloud scan request for each executable that is about to run. If the verdict comes back malicious, HitmanPro.Alert blocks the launch before the program can do anything.
For a full check of the PC, the Scan Computer command runs HitmanPro in the background. Because HitmanPro.Alert includes all HitmanPro features, the same scan cleans out viruses, trojans, worms, rootkits, spyware, keyloggers and trackers that are already on the system. It can also replace infected Windows resources with clean original versions.
Exploit protection for vulnerable applications
A large part of HitmanPro.Alert wraps commonly attacked programs, such as browsers, Microsoft Office and PDF readers, in extra security layers. Instead of looking for known malware, these layers watch for the techniques used to abuse flaws in legitimate programs.
HitmanPro.Alert groups applications into templates because a browser and a media player do not need the same settings. There are templates for browsers, browser plugins, Java, media players, office suites and document readers. Templates also cover HitmanPro itself and testing tools. An Other template covers any application the user adds manually.
The mitigations fall into two groups:
- Code mitigations include Control-Flow Integrity against return-oriented programming (ROP), Stack Pivot and Stack Exec checks, Import Address Table filtering, JIT Guard for browser just-in-time memory, SEHOP for the exception handler chain and a block on loading modules from network paths.
- Memory mitigations enforce DEP against buffer-overflow abuse, apply mandatory and bottom-up ASLR so code locations are harder to predict, and block null-page and heap-spray techniques.
Application Lockdown sits on top of these. When a productivity program such as Word drops a new executable and tries to run it, or launches PowerShell or wscript from a document, HitmanPro.Alert blocks the code. This stops macro-based downloaders without needing a signature, although a legitimate updater that uses unsigned files can trigger the same block.
CryptoGuard against ransomware
CryptoGuard watches how files are being encrypted rather than which program is doing it. When it sees unauthorized encryption, HitmanPro.Alert backs up the affected files, stops and removes the ransomware, and returns the files to their original state. This happens without user interaction and without ransomware signatures.
A related protection, WipeGuard, keeps the master and volume boot records from being overwritten. Writing a bootable image to a USB drive can trip this protection. For that job, users can temporarily turn off the Master Boot Record option in the CryptoGuard settings.
Credentials, keystrokes and browser sessions
Keystroke encryption scrambles keyboard input, so a keylogger running on the PC records unusable data instead of card numbers or passwords. HitmanPro.Alert also checks whether other software is monitoring critical browser functions and raises an intruder alert when it finds suspicious changes inside a browser.
Credential Theft Protection guards the Windows credential stores (LSASS and SAM) against password and hash theft. Its CookieGuard part covers Chromium-based browsers. It stops any application that tries to read saved passwords or authentication cookies from a protected browser, whether or not the application is otherwise malicious. Remote Desktop Lockdown can require a second factor or token on the machine, so an attacker who logs in with stolen credentials cannot introduce new code.
System-wide hardening
Several protections apply to the whole machine rather than individual applications:
- Process Protection blocks process hollowing, insertion of authentication tokens to raise privileges, code injection through code caves, the heap or asynchronous procedure calls, DLL hijacking and tools that abuse vulnerable drivers to kill security software.
- Webcam notifier shows an alert whenever a program turns on the webcam and records details in the Windows Event Log.
- BadUSB protection stops malicious USB devices, for example in an evil maid attack.
- Vaccination stops sandbox-aware malware.
Attack alerts and false positives
When HitmanPro.Alert blocks something, it shows an Attack Intercepted alert. Its Technical Details name the module that fired, such as StackPivot, ROP, CookieGuard, LockDown or CryptoGuard. They also give a short description of the attack type, with MITRE ATT&CK IDs where available.
The event log keeps past alerts. For each one, the user can view the process tree involved, look up the triggering file’s hash on VirusTotal, or suppress the alert. Suppressing works as a whitelist for false positives, and the user can undo it later.
HitmanPro.Alert opens in a simplified standard interface for everyday users. Most of the settings described above appear after switching to the advanced interface from the gear icon. These include individual mitigations and CryptoGuard options.
