App Review Crowdstrike Falcon Review | Tested vs Malware

[Wraith]

Everyone knows about your longstanding vendetta against Dan. So let's get that out there for posterity so people know there is a history and we can move on to more important matters.

Get Cylance or Crowdstrike+VS (Always On, Aggressive) over to the malware hub in appropriately allocated VM's, throw everything at it, including non-traditional attacks and lets see the test results. I think it would be interesting.

Back on topic, I think CS is an interesting offering, but probably needs some ancillary assistance.

Cylance + VS won't be much of a test since VS will block all the files from running. It's like testing an AV alongwith AppGuard. I think a more suitable test will be WD + Cylance to see what benefits these claimed "next-gen" AV's can offer compared to the traditional ones.

 

[436880927]

Everyone knows about your longstanding vendetta against Dan. So let's get that out there for posterity so people know there is a history and we can move on to more important matters.

We aren't talking about the owner of VoodooShield. We're talking about you. You and your misinformation.

I will ask you again: stop posting nonsense @ForgottenSeer 58943.

 

[oldschool]

Get Cylance or Crowdstrike+VS (Always On, Aggressive) over to the malware hub in appropriately allocated VM's, throw everything at it, including non-traditional attacks and lets see the test results. I think it would be interesting.

I've been wishing for just this for quite awhile now, but realize that Hub testers have their priorities. Maybe at some point this wish will be realized ...

 

[Wraith]

I've been wishing for just this for quite awhile now, but realize that Hub testers have their priorities. Maybe at some point this wish will be realized ...

Testing Cylance is okay but I'm not so sure about VS. by default VS will block all the samples from being executed since it allows only whitelisted items to be run from user space. It'll be like testing AppGuard that will block all non whitelisted items execution from user space and hence no malware can run.

 

[artek]

Testing Cylance is okay but I'm not so sure about VS. by default VS will block all the samples from being executed since it allows only whitelisted items to be run from user space. It'll be like testing AppGuard that will block all non whitelisted items execution from user space and hence no malware can run.

Which is the paradoxical thing to me about most hips programs being advocated for general use by consumers. Most of them are getting infected by files they're choosing to run. And when you're not a novice user you're not going to run those files anyway so what's the point?

 

[oldschool]

Testing Cylance is okay but I'm not so sure about VS. by default VS will block all the samples from being executed since it allows only whitelisted items to be run from user space. It'll be like testing AppGuard that will block all non whitelisted items execution from user space and hence no malware can run.

Yes, but I'd add these two points: VS in Autopilot is the recommended mode for testing because it performs most like an AV. And we might recall that Hard_Configurator was tested by @askalan. I appreciated those even if they got a little boring. Where has he been anyway?

 

[Wraith]

Yes, but I'd add these two points: VS in Autopilot is the recommended mode for testing because it performs most like an AV. And we might recall that Hard_Configurator was tested by @askalan. I appreciated those even if they got a little boring. Where has he been anyway?

Generally combos are not allowed to be tested in the hub(except SysHardener) since they skew the effectiveness of the suite/AV. In the next malware samples test, I'll make a ESET + VS test for you and PM you the screenshots. Sadly I don't have a Cylance license and so can't test it.

 

[Evjl's Rain]

cylance + SH combo is quite interesting to see because we know cylance is close to useless against scriptors
still, cylance is not a complete package because it still misses a lot of .exe malwares