Advice Request Best behavior blocker/0 day

[likeastar20]

Title. What's your top 3?

 

[Soulbound]

Standalone or part of a suite?

 

[Kongo]

I'd vote for either Kaspersky or Norton. One not so popular product with great behavioural protection is G-Data.

 

[marcopaone]

Kaspersky.

Also the best for 0 day but not behavior is AppGuard

 

[ScandinavianFish]

Kaspersky's System Watcher.

Also, antiviruses does not need to monitor the behavior of an application to detect new malware, pretty much all AV's use static machine learning, Windows Defender for example use 7 different machine learning models, both local and in the cloud, to detect zero days.

 

[Soulbound]

Kaspersky is the most easier to use in my opinion (granted you are using KIS and up).
ESET HIPS if you decide to take some time to do some configuration, works wonders, although basic rules are decent enough for average joe.
Norton also works out of the box.
VoodooShield also has its fair share of popularity

since this thread is not just about BB but also Zero Day solutions, above 4 are my main goto's

 

[Trooper]

Kaspersky by far.
Norton
ESET

 

[TairikuOkami]

Actually Defender is quite effective, thus the reason I have to disable it ASAP. Avast and AVG are undeniably good as well. But I can not decide whether to vote for Kaspersky or WiseVector.

 

[RansomwareRemediation]

1. Bitdefender ATC
2. Norton Sonar
3. Avast BB
4. Kaspersky SW
5. F-secure DG
6. Comodo
Greetings.

 

[Anthony Qian]

First tier: Bitdefender ATD, Kaspersky SW

Second tier: Norton SONAR (bad protection against ransomware and some stealer), Emsisoft (no rollback), Avast IDP (inadequate protection against ransomware)

Third tier: F-Secure DG (relatively high FPs, no rollback), McAfee RP (bad protection against script, depends on Cloud)

Fourth tier: ESET DBI and RS (insensitive), Trend Micro (high FPs in hypersensitive mode, not sensitive in normal mode), Avira Sentry (insensitive to malware, produce FPs in my testing)

 

[Faybert]

From the experience in all these years of testing: G Data, Kaspersky and Norton.

 

[lvseqiji]

Wisevector Kaspersky and Bitdefender.
Especially Wisevector, its BB can get great results without any fancy cloud services.

 

[Shadowra]

Kaspersky, Emsisoft, Eset, Bitdefender, Gdata

 

[Moonhorse]

Comodo or wisevector

 

[Kiss]

Kaspersky by far.
Norton
ESET

Eset has no behavior blocker

 

[plat]

I think "behavior blocker" and HIPS (host intrusion prevention system) get confused sometimes.

I'm still evaluating real-time software that functions alongside Defender but has a tiny footprint. NVT OS Armor and VoodooShield are the two I have currently (each on a separate drive). The recent Follina episode spurred both and some others to take a closer look and make improvements.

 

[Moonhorse]

I think "behavior blocker" and HIPS (host intrusion prevention system) get confused sometimes.

I'm still evaluating real-time software that functions alongside Defender but has a tiny footprint. NVT OS Armor and VoodooShield are the two I have currently (each on a separate drive). The recent Follina episode spurred both and some others to take a closer look and make improvements.

checkmall apparently uploading new videos but i dont think that is what you are looking for

 

[Soulbound]

Eset has no behavior blocker

refer to title itself:

Best behavior blocker/0 day​

All solutions discussed here have either BB or a zero day module. Thread was not about BB only...

Eset has Hips and its own engine mechanism.

 

[Minimalist]

IMO Emsisoft's BB is quite good.

 

[SeriousHoax]

First tier: Bitdefender ATD, Kaspersky SW

Second tier: Norton SONAR (bad protection against ransomware and some stealer), Emsisoft (no rollback), Avast IDP (inadequate protection against ransomware)

Third tier: F-Secure DG (relatively high FPs, no rollback), McAfee RP (bad protection against script, depends on Cloud)

Fourth tier: ESET DBI and RS (insensitive), Trend Micro (high FPs in hypersensitive mode, not sensitive in normal mode), Avira Sentry (insensitive to malware, produce FPs in my testing)

This summed it up perfectly. Don't think anyone would disagree with this.