Appendix E - How files determined to be suspicious (Low, Medium or High)
Scanned files are determined to be suspicious based on a score. The score is comprised of a collection of behavioral or file attributes collected during the scan process.
|
Rating |
Description |
|---|---|
| Low Risk |
A file is categorized as Low Risk when only a minimal number of anomalies are detected in the file's structure or behavior. This implies that while the file is not entirely typical, any potential threat it might pose to system integrity or data security is negligible. |
| Medium Risk |
A file is assigned a Medium Risk level when there's a reasonable likelihood of it carrying or initiating malicious activity. The potential damage posed by such a file is considered moderate. It may cause some disruptions or minor system compromises, but not to a severe degree. |
| High Risk |
A file is labeled as High Risk when there's an immediate and substantial threat of harmful actions or features. These files pose a significant threat to system security and integrity, potentially leading to major data breaches or system failures. Immediate action is typically recommended to mitigate the risks posed by high-risk files. |