Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 927180" data-attributes="member: 32260">Anyway, adding malware exclusions like in the case of the DeroHE ransomware payload (iobit.dll), can have an impact on malware persistence.In most cases, the post-execution behavior-based detections in Microsoft cloud can detect the malware after some minutes. If the malware is not excluded, then the infection chain will be killed and the encryption will be often interrupted. If the malware is excluded in the meantime, then it will survive and the encryption will continue.In the case of ransomware in the home environment, this is not so important because the user&#039;s files are often encrypted before post-execution detection will work. But in businesses, this difference can be crucial because there are much more data and the full encryption can last several hours.So, adding malware exclusions can have two opposite causes:<ol>
<li data-xf-list-type="ol">Negative for the attacker: 
Exclusions are suspicious and can increase the malware detection on the pre-execution stage. This can be an important disadvantage especially when advanced WD settings are enabled (like higher Cloud Protection Level or ASR rule &quot;Use advanced protection against ransomware&quot;).</li>
<li data-xf-list-type="ol">Positive for the attacker: exclusions can increase the malware persistence.</li>
</ol></blockquote>

[QUOTE="Andy Ful, post: 927180, member: 32260"] Anyway, adding malware exclusions like in the case of the DeroHE ransomware payload (iobit.dll), can have an impact on malware persistence. In most cases, the post-execution behavior-based detections in Microsoft cloud can detect the malware after some minutes. If the malware is not excluded, then the infection chain will be killed and the encryption will be often interrupted. If the malware is excluded in the meantime, then it will survive and the encryption will continue. In the case of ransomware in the home environment, this is not so important because the user's files are often encrypted before post-execution detection will work. But in businesses, this difference can be crucial because there are much more data and the full encryption can last several hours. So, adding malware exclusions can have two opposite causes: [LIST=1] [*]Negative for the attacker: Exclusions are suspicious and can increase the malware detection on the pre-execution stage. [B]This can be an important disadvantage especially when advanced WD settings are enabled (like higher Cloud Protection Level or ASR rule "Use advanced protection against ransomware").[/B] [*]Positive for the attacker: exclusions can increase the malware persistence. [/LIST] [/QUOTE]

Verification