Nothing spreads through the share.

A file placed on a share reaches everyone who opens it. CDR neutralizes it at the point of entry, before it can travel.

Follow one file onto the share.

A share hands every file to everyone who opens it. So the file is dealt with once, at the entry, and what spreads is the rebuilt copy.

At the entry

HookMesh sits where files come onto the share, whoever sends them: a colleague, a partner drop, a sync client. Nothing is written until it has been through.
HookMesh
CDR

Every document is taken apart, stripped of macros, scripts and embedded objects, and rebuilt in milliseconds. The copy that lands on the share is the only one anyone opens.
CDR
Analysis

What cannot be rebuilt is scanned and run first, both at once. A clean verdict lets it on; anything else is held, and the verdict goes to your SIEM.
Static analysis Sandbox

Shared drives are built to spread files. That is their job. It is also what makes one malicious document a problem for the whole company.

Malware propagates across internal shares the same way a report does: somebody opens it, and then somebody else does.

Once inside, the file is trusted. Nobody scans a colleague’s folder.

CDR guards against malware spreading through shared files. Each file is taken apart and rebuilt as a clean copy as it enters the share.

Propagation stops at the door. There is no infected original left on the share to travel across the network.

It is comprehensive defense at the point of entry, applied to every file rather than only the ones that look suspicious.

Where it sits: At the point of entry to the share, before a file is written where others can open it.
What happens to the file: CDR rebuilds it, 50 or more file types in milliseconds. HookMesh can add static and dynamic analysis, and route the verdict to your SIEM, SOAR or ticketing.
Powered by: HookMesh CDR

Tell us where your files live. We will show you one going in and coming out.