A financial services company has deployed Cisco Secure Endpoint on all Windows workstations. During a recent incident, attackers used a weaponized document that injected malicious code into a legitimate running process (a technique that leaves no file on disk) to execute a fileless attack. The security team wants to enable the Secure Endpoint capability that specifically defends against this class of in-memory attack without relying on file hash lookups or signature matching. Which Secure Endpoint engine should they enable?