Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1055989" data-attributes="member: 96560"><p>I should add that hackers do not rely on malware that is detectable by common AV&#039;s. They test their tools against common AV&#039;s to make sure that they are not detectable before deploying them. So if you are relying on your anti-malware to stop hackers you will be defeated every time. My &#039;red team&#039; has never used a tool that my various big name AV&#039;s could detect. Examples are remote access tools and windows features disruption tools. That is where an EDR like Comodo&#039;s OpenEDR comes in. Windows events record everything. It&#039;s just that the major AV&#039;s don&#039;t identify them as suspicious. But a human can see that something sticks out and shouldn&#039;t be happening. An example is a &#039;Write to executable&#039; event (create exe) or a &#039;Binary executing from Temp directory&#039; event happening when you did not install anything. AV&#039;s won&#039;t blink but a human will know something is wrong. And EDR&#039;s has the comprehensive Mitre Att&amp;ck hacker tactics covered. It filters Windows events and raises Alerts for you to review and decide upon. Most importantly, it clues in that your defenses has a hole and you need to address it. If you are serious about security, you should have an EDR tool - it is an essential layer of defense.</p></blockquote><p></p>

[QUOTE="Victor M, post: 1055989, member: 96560"] I should add that hackers do not rely on malware that is detectable by common AV's. They test their tools against common AV's to make sure that they are not detectable before deploying them. So if you are relying on your anti-malware to stop hackers you will be defeated every time. My 'red team' has never used a tool that my various big name AV's could detect. Examples are remote access tools and windows features disruption tools. That is where an EDR like Comodo's OpenEDR comes in. Windows events record everything. It's just that the major AV's don't identify them as suspicious. But a human can see that something sticks out and shouldn't be happening. An example is a 'Write to executable' event (create exe) or a 'Binary executing from Temp directory' event happening when you did not install anything. AV's won't blink but a human will know something is wrong. And EDR's has the comprehensive Mitre Att&ck hacker tactics covered. It filters Windows events and raises Alerts for you to review and decide upon. Most importantly, it clues in that your defenses has a hole and you need to address it. If you are serious about security, you should have an EDR tool - it is an essential layer of defense. [/QUOTE]

Verification