Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1099659" data-attributes="member: 32260">You can conclude nothing in general from the test with one sample. If you did, then your conclusion would be irrational even if true. When thinking rationally, such a video can only be an example of something confirmed in another way.Currently, most AVs use behavior-based detections. So, the AV vendors consider such detections important. The main purpose of using behavior-based detections are morphed samples. It means that the malware used in the video will not become prevalent by using 1000 morphed copies. Most of them will be detected, even if a few initial samples could bypass AVs. This is also a clear difference compared to old-fashioned AVs.If you need protection against 0-day exploits, then you should install an AV with a good anti-exploit module and minimize the attack surface (Standard User Account, fresh updates, system/software hardening, applications running in AppContainer, etc.). The standard behavior modules are not so efficient and often focus on the post-exploitation phase. If you do not like 3rd party AVs, you can apply Windows built-in anti-exploit and application control features.</blockquote>

[QUOTE="Andy Ful, post: 1099659, member: 32260"] You can conclude nothing in general from the test with one sample. If you did, then your conclusion would be irrational even if true. When thinking rationally, such a video can only be an example of something confirmed in another way. Currently, most AVs use behavior-based detections. So, the AV vendors consider such detections important. The main purpose of using behavior-based detections are morphed samples. It means that the malware used in the video will not become prevalent by using 1000 morphed copies. Most of them will be detected, even if a few initial samples could bypass AVs. This is also a clear difference compared to old-fashioned AVs. If you need protection against 0-day exploits, then you should install an AV with a good anti-exploit module and minimize the attack surface (Standard User Account, fresh updates, system/software hardening, applications running in AppContainer, etc.). The standard behavior modules are not so efficient and often focus on the post-exploitation phase. If you do not like 3rd party AVs, you can apply Windows built-in anti-exploit and application control features. [/QUOTE]

Verification