Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 837218" data-attributes="member: 32260">SUMMARY of WD offline non-signature detection/blocking on Windows Home and Pro.<ol>
<li data-xf-list-type="ol">WD offline non-signature detection uses Machine Learning models, behavior-based algorithms, generics (based on similarities to known malware), and heuristics.</li>
<li data-xf-list-type="ol">AMSI is used to log/detect unobfuscated script actions.</li>
<li data-xf-list-type="ol">Most of these features apply to images in memory and are optimized to detect suspicious behavior and trigger the cloud backend. </li>
<li data-xf-list-type="ol">WD can be configured to use also ASR rules and Controlled Folder Access to block locally, malicious behaviors.</li>
</ol>It seems that WD main offline protection is based on malware signatures, and can be extended by using ASR rules and Controlled Folder Access. Other features are mostly the interlude to the cloud backend.Of course, in the home environment, offline protection is supported by cloud protection even when the user is offline! The main malware delivery is due to the Internet, so if the user is well protected online (web protection, BAFS, etc.), then there is usually no malware on disk when being offline. This may work well for many users, but there are some exceptions, for example when downloading/unpacking files without MOTW (like from USB drives, via 7-ZIP unpacker, etc.).</blockquote>

[QUOTE="Andy Ful, post: 837218, member: 32260"] [B]SUMMARY[/B] of [B][COLOR=rgb(41, 105, 176)]WD offline [/COLOR][/B][SIZE=4][COLOR=rgb(41, 105, 176)][B]non-signature[/B][/COLOR][/SIZE] detection/blocking on Windows Home and Pro. [LIST=1] [*]WD offline non-signature detection uses Machine Learning models, behavior-based algorithms, generics (based on similarities to known malware), and heuristics. [*]AMSI is used to log/detect unobfuscated script actions. [*]Most of these features apply to images in memory and are optimized to [COLOR=rgb(184, 49, 47)][B]detect suspicious behavior and trigger the cloud backend. [/B][/COLOR] [*]WD can be configured to use also ASR rules and Controlled Folder Access to block locally, malicious behaviors. [/LIST] It seems that WD main offline protection is based on malware signatures, and can be extended by using ASR rules and Controlled Folder Access. Other features are mostly the interlude to the cloud backend. Of course, in the home environment, offline protection is supported by cloud protection even when the user is offline! The main malware delivery is due to the Internet, so if the user is well protected online (web protection, BAFS, etc.), then there is usually no malware on disk when being offline. This may work well for many users, but there are some exceptions, for example when downloading/unpacking files without MOTW (like from USB drives, via 7-ZIP unpacker, etc.). [/QUOTE]

Verification