Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 964313" data-attributes="member: 32260">Among 15 testing scenarios, there is an interesting sample nr 14 (corrected numbering) that managed to bypass the protection of 4 AVs. In the case of Avast, it was most probably blocked by Cyber Capture.The attack was performed via spearphishing link, so the EXE file (masquerading werfault.exe) was downloaded/executed (MOTW added by the web browser). The MOTW is required for an EXE file to trigger Cyber Capture, so the file was uploaded and detonated in the cloud sandbox.Another interesting example is sample nr 12 (corrected numbering). This sample could bypass 5 AVs (including Avast). The Avast CyberCapture could not block it. This attack is similar to scenario 14 (which was blocked by Avast). There is a note about this in the report:Edit.Post edited to include the corrections due to scenario numbering error in the online report.I removed the note about scenario 12 (incorrect numbering) because, in fact, it was about scenario 13 (correct numbering). This scenario was blocked by Avast (script was blocked). If this script was not blocked then CyberCapture could not detect the DLL sideloading technique.</blockquote>

[QUOTE="Andy Ful, post: 964313, member: 32260"] Among 15 testing scenarios, there is an interesting sample nr 14 (corrected numbering) that managed to bypass the protection of 4 AVs. In the case of Avast, it was most probably blocked by Cyber Capture. The attack was performed via spearphishing link, so the EXE file (masquerading werfault.exe) was downloaded/executed (MOTW added by the web browser). The MOTW is required for an EXE file to trigger Cyber Capture, so the file was uploaded and detonated in the cloud sandbox. Another interesting example is sample nr 12 (corrected numbering). This sample could bypass 5 AVs (including Avast). The Avast CyberCapture could not block it. This attack is similar to scenario 14 (which was blocked by Avast). There is a note about this in the report: Edit. Post edited to include the corrections due to scenario numbering error in the online report. I removed the note about scenario 12 (incorrect numbering) because, in fact, it was about scenario 13 (correct numbering). This scenario was blocked by Avast (script was blocked). If this script was not blocked then CyberCapture could not detect the DLL sideloading technique. [/QUOTE]

Verification