Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1121697" data-attributes="member: 32260">It would be good to agree on MT on the meaning of Unknown and FUD malware. Both malware types are strictly related to this thread.My propositions:Unknown malware (Never-before-seen) - the malware that is undetected by AV signatures.Unknown malware can be created by slightly changing the file content, packing/encrypting the known malware sample, code obfuscation, replacing/modifying functions and attack vectors, applying new exploits, using new compilers or scripting engines, etc.FUD (Fully UnDetectable) malware - the Unknown variant of known malware created by hiding the content of known malware via packing/encrypting or obfuscating.The Scantime FUD prevents static detection. The Runtime FUD also prevents dynamic detection (uses fileless methods to run the known malware from memory).Another problem is with 0-day malware. It is used on MT in two different meanings :<ol>
<li data-xf-list-type="ol">Malware that uses a 0-day exploit. 
[URL unfurl=&quot;true&quot;]https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-zero-day-attack/what-is-zero-day-malware/[/URL]</li>
<li data-xf-list-type="ol">Never-before-seen malware. 
[URL unfurl=&quot;true&quot;]https://www.crowdstrike.com/en-us/blog/zero-day-malware-classification-automation/[/URL]</li>
</ol>Finally the note on &quot;Behavioral Protection.&quot;My proposition: Signature-less protection that uses behavior monitoring or AI signals to detect/block threats in realtime.For example, the real-time detonation in the cloud sandbox is part of &quot;Behavioral Protection&quot;, but detection via the AV local scan engines is not.This definition often requires malware execution (locally or in the cloud). However, it also covers features such as HIPs, ASR rules, etc., where benign processes are restricted and malware execution is prevented (for example MS Word cannot execute PowerShell, or suspicious file execution is suspended by local AI to apply additional signature-less security layers).</blockquote>

[QUOTE="Andy Ful, post: 1121697, member: 32260"] It would be good to agree on MT on the meaning of Unknown and FUD malware. Both malware types are strictly related to this thread. My propositions: [B]Unknown malware (Never-before-seen) - the malware that is undetected by AV signatures.[/B] Unknown malware can be created by slightly changing the file content, packing/encrypting the known malware sample, code obfuscation, replacing/modifying functions and attack vectors, applying new exploits, using new compilers or scripting engines, etc. [B]FUD (Fully UnDetectable) malware - the Unknown variant of known malware created by hiding the content of known malware via packing/encrypting or obfuscating.[/B] The Scantime FUD prevents static detection. The Runtime FUD also prevents dynamic detection (uses fileless methods to run the known malware from memory). Another problem is with 0-day malware. It is used on MT in two different meanings : [LIST=1] [*]Malware that uses a 0-day exploit. [URL unfurl="true"]https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-zero-day-attack/what-is-zero-day-malware/[/URL] [*]Never-before-seen malware. [URL unfurl="true"]https://www.crowdstrike.com/en-us/blog/zero-day-malware-classification-automation/[/URL] [/LIST] Finally the note on "[B]Behavioral Protection[/B]." My proposition: [B]Signature-less protection that uses behavior monitoring or AI signals to detect/block threats in realtime.[/B] For example, the real-time detonation in the cloud sandbox is part of "Behavioral Protection", but detection via the AV local scan engines is not. This definition often requires malware execution (locally or in the cloud). However, it also covers features such as HIPs, ASR rules, etc., where benign processes are restricted and malware execution is prevented (for example MS Word cannot execute PowerShell, or suspicious file execution is suspended by local AI to apply additional signature-less security layers). [/QUOTE]

Verification