AVLab.pl Advanced In-The-Wild Malware Test results for March 2025

[Trident]

That is my opinion too.

The rollback as well is poorly documented, there is no official documentation that explains it. Of course we can dive into the patents and find out even the mathematical formulas behind the clustering but that’s not the point.

My question is, if untrusted process cuteGirl.exe spawns PowerShell and through that destroys or exfiltrates data, would the actions of the not-monitored and trusted PowerShell be undone?

 

[Andy Ful]

My question is, if untrusted process cuteGirl.exe spawns PowerShell and through that destroys or exfiltrates data, would the actions of the not-monitored and trusted PowerShell be undone?

Probably not, but adding CMD, PowerShell, MSHTA (and maybe some more LOLBins) to monitored processes can improve the detection.
Anyway, Webroot can be easily tweaked to block unknown executables, which works as a slightly more comprehensive brother of Windows SmartScreen.
Fileless attacks are not so common at home, but they can also be mainly covered by blocking CMD, PowerShell, MSHTA, etc. (the simplest&fast method is via Windows Exploit Protection "Disable Win32k system calls"). Webroot mentioned this alternative in the documentation:

https://www-cdn.webroot.com/4715/9259/4048/Webroot_Evasion_Shield_WP.pdf

If one likes Webroot, the above setup at home is probably as good as tweaked top AVs. Of course, similar improvements can also be done with other solutions by tweaking the settings (which is slightly more convenient).