Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 902093" data-attributes="member: 32260">I found a nice picture of the WD local and cloud script protection:[ATTACH=full]245615[/ATTACH]&quot;On endpoints, performance-optimized machine learning models inspect script content and behavior through AMSI. When scripts run and malicious or suspicious behavior is detected, features are extracted from the content, including expert features, features selected by machine learning, and fuzzy hashes. The lightweight client machine learning models make inferences on the content. If the content is classified as suspicious, the feature description is sent to the cloud for full real-time classification. In the cloud, heavier counterpart machine learning models analyze the metadata and uses additional signals like file age, prevalence, and other such information to determine whether the script should be blocked or not.These pairs of AMSI-powered machine learning classifiers, one pair for each scripting engine, allow Microsoft Defender ATP to detect malicious behavior and stop post-exploitation techniques and other script-based attacks, even after they have started running.&quot;[URL unfurl=&quot;true&quot;]https://www.microsoft.com/security/blog/2020/08/27/stopping-active-directory-attacks-and-other-post-exploitation-behavior-with-amsi-and-machine-learning/[/URL]AMSI and ASR rules are a part of the WD behavior blocking protection (local and cloud-based, pre and post-execution) focused on scripting attacks.</blockquote>

[QUOTE="Andy Ful, post: 902093, member: 32260"] I found a nice picture of the WD local and cloud script protection: [ATTACH type="full" alt="WDscriptprot.png"]245615[/ATTACH] "[I]On endpoints, performance-optimized machine learning models inspect script content and behavior through AMSI. When scripts run and malicious or suspicious behavior is detected, features are extracted from the content, including expert features, features selected by machine learning, and fuzzy hashes. The lightweight client machine learning models make inferences on the content. If the content is classified as suspicious, the feature description is sent to the cloud for full real-time classification. In the cloud, heavier counterpart machine learning models analyze the metadata and uses additional signals like file age, prevalence, and other such information to determine whether the script should be blocked or not. These pairs of AMSI-powered machine learning classifiers, one pair for each scripting engine, allow Microsoft Defender ATP to detect malicious behavior and stop post-exploitation techniques and other script-based attacks, even after they have started running.[/I]" [URL unfurl="true"]https://www.microsoft.com/security/blog/2020/08/27/stopping-active-directory-attacks-and-other-post-exploitation-behavior-with-amsi-and-machine-learning/[/URL] AMSI and ASR rules are a part of the WD behavior blocking protection (local and cloud-based, pre and post-execution) focused on scripting attacks. [/QUOTE]

Verification