Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1032633" data-attributes="member: 32260">KnowBe4 Simulator Ransomware testPart 1:&nbsp; all attack scenarios detected/blocked.ConfigureDefender set to HIGH + ASR prevalence rule (Block executable files from running unless they meet a prevalence, age, or trusted list criteria)[ATTACH=full]273931[/ATTACH]Part 2:&nbsp; 7 attack scenarios bypassed Defender.ConfigureDefender set to HIGH (without enabled ASR prevalence rule):[ATTACH=full]273932[/ATTACH]---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------KnowBe4 Simulator uses loaders (*.cxp files) executed via WMI, that can load payloads (*.dlm,&nbsp; *.exe, *.bin, ...).All files are created by the simulator and are different in each test.The ASR prevalence rule can block such attacks. Many of them are also detected by Defender at the pre-execution level (behavior-based detections: Trojan:Win32/Wacatac.B!ml,&nbsp; Program:Win32/Wacapew.C!ml).This is not a real-world test and cannot be used to show the true capabilities of AV. I used it to show the effectiveness of the ASR prevalence rule. Of course, all samples could be also blocked by enabling the ASR rule related to WMI commands. Other ASR rules did not block anything due to the special form of KnowBe4 tests.Edit.A similar test for other AVs was done on MT:[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/ransomware-simulator-vs-10-avs.113267/#post-984441[/URL]Generally, most AVs scored poorly (with some exceptions). But, this can follow from a special testing procedure (uncommon in the wild).</blockquote>

[QUOTE="Andy Ful, post: 1032633, member: 32260"] [B][SIZE=5]KnowBe4 Simulator Ransomware test[/SIZE] Part 1:[/B] all attack scenarios detected/blocked. ConfigureDefender set to HIGH + ASR prevalence rule (Block executable files from running unless they meet a prevalence, age, or trusted list criteria) [ATTACH type="full" alt="1679960769264.png"]273931[/ATTACH] [B]Part 2: [/B]7 attack scenarios bypassed Defender. ConfigureDefender set to HIGH (without enabled ASR prevalence rule): [ATTACH type="full" alt="1679961171001.png"]273932[/ATTACH] --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- KnowBe4 Simulator uses loaders (*.cxp files) executed via WMI, that can load payloads (*.dlm, *.exe, *.bin, ...). All files are created by the simulator and are different in each test. The ASR prevalence rule can block such attacks. Many of them are also detected by Defender at the pre-execution level (behavior-based detections: Trojan:Win32/Wacatac.B!ml, Program:Win32/Wacapew.C!ml). This is not a real-world test and cannot be used to show the true capabilities of AV. I used it to show the effectiveness of the ASR prevalence rule. Of course, all samples could be also blocked by enabling the ASR rule related to WMI commands. Other ASR rules did not block anything due to the special form of KnowBe4 tests. Edit. A similar test for other AVs was done on MT: [URL unfurl="false"]https://malwaretips.com/threads/ransomware-simulator-vs-10-avs.113267/#post-984441[/URL] Generally, most AVs scored poorly (with some exceptions). But, this can follow from a special testing procedure (uncommon in the wild). [/QUOTE]

Verification