Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1099556" data-attributes="member: 99014">Antivirus software is not unimportant, just the top 4-5&nbsp; home security vendors together, daily:<ul>
<li data-xf-list-type="ul">Generate more events on their cloud (look-ups, blocks, updates) than Google, which is estimated to total at about 3.5 bln events daily.</li>
<li data-xf-list-type="ul">Block hundreds of thousands of malicious files and sites every single day across millions of machines</li>
<li data-xf-list-type="ul">Take hundreds of thousands of security decisions.</li>
<li data-xf-list-type="ul">Protect real users in real-life situations from getting screwed.</li>
</ul>You should not be testing security software by disabling modules, if a module has produced detection then you should consider the sample as “gone” and you should work on new sample.In terms of what you call behavioural analyse, the behavioural blocker is not a magician. It does work and it blocks hundreds of zero days every hour. Some of them will be blocked on time, some of them not so much. Some of them will be a total miss. You’ll get better results from solutions whose behavioural blocker is centred around the Mitre ATT&amp;CK and not so much around profiles (that simply block more of what is known).Home AVs are designed with multiple goals in mind, including silence, performance and lack of false positives, blocking zero-days is not the first priority.But in this case detections were produced by other modules, at this point it was game over for you and your test.</blockquote>

[QUOTE="Trident, post: 1099556, member: 99014"] Antivirus software is not unimportant, just the top 4-5 home security vendors together, daily: [LIST] [*]Generate more events on their cloud (look-ups, blocks, updates) than Google, which is estimated to total at about 3.5 bln events daily. [*]Block hundreds of thousands of malicious files and sites every single day across millions of machines [*]Take hundreds of thousands of security decisions. [*]Protect real users in real-life situations from getting screwed. [/LIST] You should not be testing security software by disabling modules, if a module has produced detection then you should consider the sample as “gone” and you should work on new sample. In terms of what you call behavioural analyse, the behavioural blocker is not a magician. It does work and it blocks hundreds of zero days every hour. Some of them will be blocked on time, some of them not so much. Some of them will be a total miss. You’ll get better results from solutions whose behavioural blocker is centred around the Mitre ATT&CK and not so much around profiles (that simply block more of what is known). Home AVs are designed with multiple goals in mind, including silence, performance and lack of false positives, blocking zero-days is not the first priority. But in this case detections were produced by other modules, at this point it was game over for you and your test. [/QUOTE]

Verification