Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1110526" data-attributes="member: 32260">Some readers may doubt why Avast&#039;s CyberCapture cannot detect the attack in the cloud Sandbox. So, let&#039;s look at the alternatestreamview.exe process in the Process Explorer:[ATTACH=full]286548[/ATTACH]We can see many DLLs loaded by this executable. CyberCapture does not send all those Dlls to the sandbox, only the EXE file can be sent if it is recognized as suspicious. So, even if the alternatestreamview.exe would be unknown and suspicious, CyberCapture could only examine how this executable behaves in the virtual environment with DLLs native to the sandbox and without the DLL used locally in the attack. This is a well-known limitation, typical to many cloud sandboxes. Otherwise, many files should be uploaded to the cloud causing performance issues, overloading the cloud, etc.The problem of DLLs can be partially solved when using file reputation cloud lookup like in Smart App Control, Norton Download Insight, etc. However, this approach gives many false positive detections. As usual, the requirement of protection usability necessitates a reduction in security.If Avast decides to check the reputation of DLLs in the future, it will probably be thanks to changes to Hardened Mode.</blockquote>

[QUOTE="Andy Ful, post: 1110526, member: 32260"] Some readers may doubt why Avast's CyberCapture cannot detect the attack in the cloud Sandbox. So, let's look at the alternatestreamview.exe process in the Process Explorer: [ATTACH type="full" alt="1733608658989.png"]286548[/ATTACH] We can see many DLLs loaded by this executable. CyberCapture does not send all those Dlls to the sandbox, only the EXE file can be sent if it is recognized as suspicious. So, even if the alternatestreamview.exe would be unknown and suspicious, CyberCapture could only examine how this executable behaves in the virtual environment with DLLs native to the sandbox and without the DLL used locally in the attack. This is a well-known limitation, typical to many cloud sandboxes. Otherwise, many files should be uploaded to the cloud causing performance issues, overloading the cloud, etc. The problem of DLLs can be partially solved when using file reputation cloud lookup like in Smart App Control, Norton Download Insight, etc. However, this approach gives many false positive detections. As usual, the requirement of protection usability necessitates a reduction in security. If Avast decides to check the reputation of DLLs in the future, it will probably be thanks to changes to Hardened Mode. [/QUOTE]

Verification