Government-Grade eScan Enterprise EDR

Comprehensive Email Security Scanning

Scans all emails in real-time for viruses, worms, Trojans, spyware, adware, and hidden malicious content using powerful, heuristic-driven dual anti-virus engines.

eScan Neural Intelligence AI/ML Defense

eScan's Neural Intelligence AI/ML Defense integrates with the EDR solution, using machine learning algorithms to enhance threat detection capabilities. By analyzing system call patterns and behavioral data, the AI engine proactively identifies unknown malware and evolving threats that signature-based detection may miss. This multi-layered approach adapts continuously to the evolving threat landscape, providing comprehensive protection against zero-day exploits and advanced persistent threats.

eScan Zero-day Defense

eScan's Zero-day Defense system uses real-time behavioral analysis and machine learning to identify and neutralize threats before conventional security measures can recognize them. By continuously monitoring system activities and correlating suspicious patterns, the AI-powered engine detects malicious code without known signatures. This preemptive approach enables immediate response to emerging threats, blocking attack vectors before they can exploit undiscovered vulnerabilities in critical infrastructure.

New Secured Unified Web Interface

eScan's secure web interface uses SSL technology to encrypt all communications. A summarized dashboard provides administrators with managed client status in graphical formats including deployment status, protection status, and protection statistics.

Asset Management

eScan's Asset Management module provides complete hardware configuration and software inventory for endpoints. This enables administrators to track all hardware and software resources on network-connected endpoints.

Role Based Administration

Role-based administration through eScan Management Console enables administrators to distribute organizational configuration and monitoring responsibilities among multiple administrators. This feature enables assignment of predefined roles to administrators, each with specific rights, permissions, and group access.

Client Live Updater

eScan's Client Live Updater captures, records, and logs eScan-related events and endpoint security status for real-time monitoring. Events can be filtered to retrieve specific information for real-time security monitoring of all managed endpoints.

Outbreak Prevention

This enables administrators to deploy outbreak prevention policies that restrict network resource access from selected computer groups for defined periods.
Outbreak prevention policies are enforced on all selected computers or groups. Incorrect policy configuration can cause significant computer functionality issues.

Print Activity

eScan includes a Print Activity module that monitors and logs printing tasks from all managed endpoints. It provides detailed reports in PDF, Excel, or HTML formats for all printing jobs from managed endpoints through local or network-connected printers.
Note: Print Activity is available on Windows endpoints only.

One-Time Password

The One-Time Password option enables administrators to disable any eScan module on client computers for specified periods. This prevents users from violating deployed network security policies.
Note: One-Time Password functionality is available on Windows endpoints only.

Session Activity Report

eScan Management Console monitors and logs managed computer session activity. It displays reports of endpoint startup, shutdown, logon, logoff, and remote session connections and disconnections. This report enables administrators to track user logon and logoff activity and remote sessions across all managed computers.

Active Directory Synchronization

Active Directory synchronization enables administrators to synchronize eScan Centralized Console groups with Active Directory containers.
Newly discovered Active Directory computers and containers automatically synchronize with eScan Management Console, with optional administrator notifications. Administrators can configure automatic installation or protection of discovered Windows workstations.

Policy Templates

Policy templates simplify deployment by enabling administrators to create and deploy templates to designated managed groups.

Windows OS and App Patch/Update Management

eScan's Patch Management Module automatically updates Windows OS security patches from the cloud or EMC Console for PCs in DMZ or air-gapped networks. The module also reports patch availability for critical applications such as Adobe and Java.

Device Control

This feature monitors USB devices connected to Windows or Mac endpoints within the network. On Windows endpoints, administrators can permit or restrict access to USB devices. Password protection can block unauthorized USB device access, preventing data leakage.

Data Theft Notification

eScan sends web console notifications to administrators when writable data from client hard drives is copied to USB devices.

Application Control

This feature enables blocking, whitelisting, and time-based restrictions for application execution on Windows endpoints. This ensures access only to whitelisted applications while blocking all other third-party applications.

Advanced Anti-Spam

eScan analyzes incoming and outgoing email content, scanning all messages in real-time for viruses, worms, Trojans, and hidden malicious content using powerful, heuristic-driven dual anti-virus engines. This prevents online threats from entering the network through email.

Enhanced Two-way Firewall

The two-way firewall with predefined rule sets restricts incoming and outgoing traffic and prevents hacking attempts. It enables configuration of firewall settings, IP ranges, permitted applications, trusted MAC addresses, and local IP addresses.

Privacy Control

Privacy control enables scheduled automatic deletion of cache, ActiveX, cookies, plugins, and browsing history. It permanently deletes files and folders beyond recovery by third-party applications, preventing data misuse.

Advanced Web Protection

eScan includes advanced Web Protection (HTTP/HTTPS) that enables administrators to define blocked or whitelisted websites for endpoints on the eScan-protected network. For Windows endpoints, eScan also provides time-based access restrictions.

On-Demand Scanning

With minimal system resource usage, eScan enables faster endpoint scanning. This ensures endpoints maintain performance during on-demand scanning of accessed or copied files and directories. Users can select specific files, folders, directories, or running processes for virus scanning.

Privacy Advisor

eScan includes Privacy Advisor, which provides a categorized list of applications using device permissions. This enables monitoring of security levels for all installed applications.

Anti-Theft

eScan provides data blocking, data wiping, SIM monitoring, and GPS location services for Android devices. The Anti-Theft feature provides complete protection against unauthorized Android device access if the device is lost or stolen.

Schedule scan

eScan provides scheduled scanning that runs seamlessly in the background without interrupting workflow. It performs scheduled scans of selected files, folders, or entire systems during designated periods, providing comprehensive protection against cyber threats.

Mobile Device Scanning

Mobile Device Scanning detects viruses, malware, and suspicious files on Android and iOS devices connected to eScan-protected endpoints. This prevents infection spread through mobile endpoints and ensures devices are secure, clean, and compliant before accessing organizational networks.

Block executable content from email client and webmail

This rule blocks executables and script files that auto-run immediately after opening an email.

• Executable files (such as .exe, .dll, or .scr)
• Script files (such as a PowerShell .ps, Visual Basic .vbs, or JavaScript .js file)

Block all Office applications from creating child processes

Malware can infect Office applications and manipulate them to execute child processes. This rule prevents all Office applications from creating child processes. This rule prevents programs from executing VBA macros, spawning commands, and using PowerShell to modify registry settings.

Block Office applications from creating executable content

Malware can exploit Office applications as a vector to save malicious files. These malicious files can evade detection and persist on systems to spread infection. This rule prevents Office programs from creating and saving suspicious executable files by blocking malicious code from writing to disk.

Block Office applications from injecting code into other processes

Cybercriminals can use programs to inject malicious code into other processes, making the code appear legitimate. This rule prevents programs from injecting code into other running processes.

Block JavaScript or VBScript from launching downloaded executable content

Executing malicious JavaScript or VBScript may download malicious payloads or run background processes without user knowledge. This rule prevents JavaScript or VBScript from executing downloaded executable content.

Block execution of potentially obfuscated scripts

Cybercriminals obfuscate scripts to reduce loading times or conceal malicious code. Consequently, malware can evade detection by both human analysis and cybersecurity solutions. This rule detects malicious code in obfuscated scripts and blocks execution upon identification.

Block Win32 API calls from Office macros

Office applications can make Win32 API calls through VBA macros. Malware can exploit this capability to abuse Office applications for Win32 API calls and execute malicious shellcode on endpoints without writing data to disk. This rule prevents VBA macros from making Win32 API calls.

Use advanced protection against ransomware

All system executable files are scanned for authenticity. If files are identified as ransomware, this rule prevents their execution. Specific files can be exempted by adding them to an exclusion list.

Block credential stealing from the Windows local security authority subsystem

Cybercriminals can use hacking tools to steal NTLM hashes and cleartext passwords from the Local Security Authority Subsystem Service (LSASS). This rule prevents credential theft by blocking access to LSASS.

Block process creations from WMI and PsExec commands

WMI and PsExec enable remote code execution. Malware can exploit this capability to execute malicious commands on systems and infect organizational networks. This rule prevents process creation through WMI and PsExec commands.

Block untrusted and unsigned processes that run from removable devices

This rule prevents untrusted and unsigned executable files (.exe, .dll, or .scr) from running from removable devices such as USB drives and SD cards.

Block Office communication application from creating child processes

This rule prevents exploit code from abusing Outlook vulnerabilities and protects against social engineering attacks. Additionally, this rule protects against forms exploits and malicious Outlook rules used by cybercriminals when user credentials are compromised. While this rule prevents Outlook from creating child processes, it permits legitimate Outlook functions.

Block Adobe Reader from creating child processes

Through exploits or social engineering, malware can abuse Adobe Reader to download malicious payloads and escape program containment. This rule prevents Adobe Reader child processes, reducing its potential as an attack vector.

Block persistence through WMI event subscription

This rule prevents malware from exploiting WMI to establish persistence on devices.

For questions regarding EDR functionality, contact the Enterprise support team at support@escanav.com