Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1124105" data-attributes="member: 99014">They use no signatures whatsoever, they rely on hash-based detection which appears to only cover executable files. I would assume they at least use fuzzy hashes, but it may as well be SHA256 or MD5 values.Then they use Infrared which is heuristics and ML-based detection again, for executable files. The behavioural blocking and rollback only deals with untrusted processes, unless someone goes and manually includes a variety of LOLBins under the monitored list. I’ve executed a wide variety of threats and have never seen the bespoke rollback in action, everything was just active in memory.The evasion shield is there on business products but is again, heuristics based, for example, it would be triggered if obfuscation (gibberish) is present. Whilst Webroot for a home user could potentially be OK (though arguably home users can do a lot better and cheaper), in the context of advanced attacks it’s comic to bring up Webroot <img class="smilie smilie--emoji" loading="lazy" alt="🙂" title="Slightly smiling face&nbsp; &nbsp; :slight_smile:" src="https://cdn.jsdelivr.net/joypixels/assets/6.6/png/unicode/64/1f642.png" data-shortname=":slight_smile:" /></blockquote>

[QUOTE="Trident, post: 1124105, member: 99014"] They use no signatures whatsoever, they rely on hash-based detection which appears to only cover executable files. I would assume they at least use fuzzy hashes, but it may as well be SHA256 or MD5 values. Then they use Infrared which is heuristics and ML-based detection again, for executable files. The behavioural blocking and rollback only deals with untrusted processes, unless someone goes and manually includes a variety of LOLBins under the monitored list. I’ve executed a wide variety of threats and have never seen the bespoke rollback in action, everything was just active in memory. The evasion shield is there on business products but is again, heuristics based, for example, it would be triggered if obfuscation (gibberish) is present. Whilst Webroot for a home user could potentially be OK (though arguably home users can do a lot better and cheaper), in the context of advanced attacks it’s comic to bring up Webroot 🙂 [/QUOTE]

Verification