Battle Bitdefender Total Security or Microsoft Defender — Who Wins for Everyday PC Users?

[Trident]

It’s all linked up and tangled, on some EDRs it is possible to see what triggered the detection, when and how (it could be one connection to a malicious C&C). Home AVs do not display such information.

Usually, pre-execution detections, even when they fail, provide information which later on is used by other components, like behavioural blocking.

So what looks like “behavioural detection” may as well be the pre-execution analysis, topped up by a few actions that couldn’t be analysed for one reason or another.
It is impossible to judge without proper logs (which rarely are provided) whether the solution is more “reliant on behaviour”. Such statements are just a very quick judgement without the necessary facts.

Anyway, a lot of solutions use more aggressive analysis on files originating from the web/email and even some machine learning models and heuristics either take this into account, or the unknown/suspicious/malicious domain will be a point of entry (they won’t be executed at all if the file is just dropped from a malware pack).

However, the standard of execution of these download protections also varies.

That’s for another thread coming up soon.

 

[Andy Ful]

The methodology used by professional labs like AV-Comparatives, AV-TEST, and others is designed to avoid these pitfalls.

They use:
* Real-World Scenarios: Their "Real-World Protection Test" starts with the malicious URL, allowing the product's entire security suite to be evaluated.

* A "Last Line of Defense" Test: Their "Malware Protection Test" is clearly defined as a test of the on-access and behavioral components after a file has landed on the disk. This test is valuable, but it is not meant to be a standalone measure of a product's overall effectiveness.

* Transparency: They publish detailed methodologies so users can understand exactly what is being tested and why.

It is not so simple. Even the Real-World tests can show the detection being delayed for several hours. Some samples detected in tests are post-factum detections that never protected users.
Those tests show that nowadays the best protection can be provided when using a popular AV and delaying the execution/opening of new files by one day. I posted about something like that five years ago:

Advice Request - Windows Defender Delay Protection.

Windows Defender Delay Protection is probably stronger than any antivirus Advanced Threat Protection (also that used in Microsoft Defender ATP in Enterprises). WDDP has an advantage that it can be easily understood and applied in a few minutes by most of the average users. So, let's forget...

malwaretips.com

I did not realize that Microsoft has already adopted a special ASR rule for that (Block executable files from running unless they meet a prevalence, age, or trusted list criterion).
A similar approach is used in Comodo Internet Security in the Internet Security Preset Configuration.

 

[ForgottenSeer 123960]

It is not so simple. Even the Real-World tests can show the detection being delayed for several hours. Some samples detected in tests are post-factum detections that never protected users.
Those tests show that nowadays the best protection can be provided when using a popular AV and delaying the execution/opening of new files by one day. I posted about something like that five years ago:

Advice Request - Windows Defender Delay Protection.

Windows Defender Delay Protection is probably stronger than any antivirus Advanced Threat Protection (also that used in Microsoft Defender ATP in Enterprises). WDDP has an advantage that it can be easily understood and applied in a few minutes by most of the average users. So, let's forget...

malwaretips.com

I did not realize that Microsoft has already adopted a special ASR rule for that (Block executable files from running unless they meet a prevalence, age, or trusted list criterion).
A similar approach is used in Comodo Internet Security in the Internet Security Preset Configuration.

Excellent points. The delayed and post-factum detections you mention are a huge blind spot in how these tests are often interpreted. A successful detection doesn't always translate to real-time protection for a user, which makes the strategy of leveraging a popular AV's telemetry and delaying execution a really smart and practical approach to dealing with new threats.

 

[Trident]

I did not realize that Microsoft has already adopted a special ASR rule for that (Block executable files from running unless they meet a prevalence, age, or trusted list criterion).
A similar approach is used in Comodo Internet Security in the Internet Security Preset Configuration.

Not only Comodo. Norton had (not sure if it now has) similar warning. Trend Micro activates it in Hypersensitive mode. And then it also performs more aggressive checks on these files/processes (post above). Webroot has similar options too.

Usually it’s not as simple as it seems, the Symantec/Norton Insight patents detailed how they take into account something which on the blog was called “secret sauce”, in essence, it would take into account what sort of user is behind the machine where the file is presented (in addition to how many). If the user frequently encounters malware infections, a formula slightly tweaks the trust.

Others prefer to not use the age/prevalence approach but prefer to check everything.
For example the Sophos, Check Point, McAfee reputations just use unknown, suspicious, malicious and safe as reputation response, they don’t track the number of users or when the file was released.

 

[Parkinsond]

“secret sauce”

You can adjust the flavor of the sauce in SEP by moving the slider on a scale of 9 grades, which was not available for "old" Norton.

 

[Trident]

You can adjust the flavor of the sauce in SEP by moving the slider on a scale of 9 grades, which was not available for "old" Norton.

It was initially, there used to be 3 levels, but in some version (now I don’t remember which one, I think it was when SDS was released) it was removed.

 

[ForgottenSeer 123960]

Not only Comodo. Norton had (not sure if it now has) similar warning. Trend Micro activates it in Hypersensitive mode. And then it also performs more aggressive checks on these files/processes (post above). Webroot has similar options too.

Usually it’s not as simple as it seems, the Symantec/Norton Insight patents detailed how they take into account something which on the blog was called “secret sauce”, in essence, it would take into account what sort of user is behind the machine where the file is presented (in addition to how many). If the user frequently encounters malware infections, a formula slightly tweaks the trust.

Others prefer to not use the age/prevalence approach but prefer to check everything.
For example the Sophos, Check Point, McAfee reputations just use unknown, suspicious, malicious and safe as reputation response, they don’t track the number of users or when the file was released.

You've clearly outlined the difference between these sophisticated, contextual reputation systems and the more basic, category-based ones. It's a great illustration of the proprietary logic and technical depth that goes into a product's trust score. In light of this complexity, it becomes even more clear why tests must be conducted in a manner that reflects the product's design, rather than in artificial or isolated settings.

 

[Trident]

You've clearly outlined the difference between these sophisticated, contextual reputation systems and the more basic, category-based ones. It's a great illustration of the proprietary logic and technical depth that goes into a product's trust score. In light of this complexity, it becomes even more clear why tests must be conducted in a manner that reflects the product's design, rather than in artificial or isolated settings.

They are not simple these reputations, just built differently. But yes, realistic tests provide more value.

 

[ForgottenSeer 123960]

They are not simple these reputations, just built differently.

The reputation systems are indeed not simple, they are just built on different philosophies and proprietary logic.

But yes, realistic tests provide more value.

They are the only way to truly evaluate these distinct and complex systems in action, as they engage all the different layers of protection a product has to offer. This is why tests that reflect a real-world infection chain are so crucial.

 

[Andy Ful]

Norton had (not sure if it now has) similar warning.

Norton used the time limit as a part of Download Insight. However, it did not work for EXE payloads dropped (not downloaded) by the initial non-EXE malware.

 

[Parkinsond]

it did not work for EXE payloads dropped

because they lack MOTW?

 

[Andy Ful]

because they lack MOTW?

If I recall correctly, the download was confirmed independently by Norton, even for files downloaded without MotW.

 

[Trident]

If I recall correctly, the download was confirmed independently by Norton, even for files downloaded without MotW.

Norton used hooks to capture the downloads. MOTW wasn’t involved. There were many SONAR rules that covered payloads dropped and downloaded by many processes, as well as suspicious executions. But not the “default-deny” style.

 

[Studynxx]

None just use mcafee or trend micro

No, use SuperAntiSpyware for bets results.

 

[Trident]

No, use SuperAntiSpyware for bets results.

Do you think McAfee/Trend Micro and SuperAntiSpyware are the same level/quality?

 

[Studynxx]

Do you think McAfee/Trend Micro and SuperAntiSpyware are the same level/quality?

Yes. McAfee is a virus in and of itself. The fact some enterprises use the EDR version is... just hilarious. I would know, I used to be a sysadmin working with ivanti DSM, and I couldn't help laughing my ass off every time we had to make and deploy a golden image that contained that EDR. Have fun lol

There's a reason why most enterprises use Sentinel One or Windows Defender EDR (whatever it's called, the EDR version of WD is actually decent)

 

[ForgottenSeer 123960]

Yes. McAfee is a virus in and of itself. The fact some enterprises use the EDR version is... just hilarious. I would know, I used to be a sysadmin working with ivanti DSM, and I couldn't help laughing my ass off every time we had to make and deploy a golden image that contained that EDR. Have fun lol

There's a reason why most enterprises use Sentinel One or Windows Defender EDR (whatever it's called, the EDR version of WD is actually decent)

The joke about McAfee being a "virus" is a common one in the IT community, and it's rooted in the frustration many experienced with older, resource-heavy versions of the software. However, it's important to look at the facts of today, as McAfee has made significant strides in improving its products.

Over the last few years, McAfee has clearly invested in overcoming its negative reputation. Independent testing labs like AV-TEST and AV-Comparatives now regularly give their consumer products high marks for both performance and effectiveness. The company has streamlined its software, and it's no longer the "resource hog" it once was.

For a home user, McAfee's current suites offer a comprehensive and effective security solution. They've moved beyond simple antivirus to include features like a secure VPN, password manager, and tools to help you manage your personal data online

For enterprises, the landscape is different. While you prefere SentinelOne or Microsoft Defender for Endpoint, these are indeed top-tier solutions, McAfee's enterprise offerings (now part of Trellix) have also evolved.

It's crucial to evaluate products based on their current performance and features rather than outdated stereotypes.

In the world of cybersecurity, what was true yesterday may not be true today. It's always best to rely on the latest data and independent test results when making a decision.

 

[TuxTalk]

Yes. McAfee is a virus in and of itself. The fact some enterprises use the EDR version is... just hilarious. I would know, I used to be a sysadmin working with ivanti DSM, and I couldn't help laughing my ass off every time we had to make and deploy a golden image that contained that EDR. Have fun lol

There's a reason why most enterprises use Sentinel One or Windows Defender EDR (whatever it's called, the EDR version of WD is actually decent)

What year do you live in ? 1990 - 2000 - 2010 ?

 

[Studynxx]

What year do you live in ? 1990 - 2000 - 2010 ?

2023, that was when I stopped being a sysadmin. nowadays I program for myself and learn new stuff via homelabbing

 

[roger_m]

2023, that was when I stopped being a sysadmin. nowadays I program for myself and learn new stuff via homelabbing

The new version of McAfee released early last year was rewritten from scratch and can't be compared with old versions.