Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1084667" data-attributes="member: 32260">There is a problem with such tests. They simulate the most popular techniques used by attackers in the past. But in the times of Malware-as-a-service, those techniques are replaced by others poorly detected by AVs. So in the tests, the AVs look good. But the reality is slightly different.In all tested scenarios, the encoded PowerShell script was written to the registry and was used to communicate with the C2 server. It is a well-known method used in the wild for several years. Most AVs can effectively use AMSI-based detections to stop such attacks at the Execution stage (if the malware is undetected at the Initial Access stage ).The widespread attacks may look possibly like that (I am not sure), but I think that the scenarios used for the Enterprise AVs could be more comprehensive by adding some other popular methods with batch scripts, HTA files, DLL hijacking, etc.[ATTACH=full]283003[/ATTACH]In the home environment, all attacks could be simply mitigated by blocking outbound connections of PowerShell (Command and Control stage).Of course, such a simple mitigation is not sufficient for many other fileless techniques.</blockquote>

[QUOTE="Andy Ful, post: 1084667, member: 32260"] There is a problem with such tests. They simulate the most popular techniques used by attackers in the past. But in the times of Malware-as-a-service, those techniques are replaced by others poorly detected by AVs. So in the tests, the AVs look good. But the reality is slightly different. In all tested scenarios, the encoded PowerShell script was written to the registry and was used to communicate with the C2 server. It is a well-known method used in the wild for several years. Most AVs can effectively use AMSI-based detections to stop such attacks at[B][COLOR=rgb(184, 49, 47)] the Execution stage[/COLOR][/B] (if the malware is undetected at the Initial Access stage ). The widespread attacks may look possibly like that (I am not sure), but I think that the scenarios used for the Enterprise AVs could be more comprehensive by adding some other popular methods with batch scripts, HTA files, DLL hijacking, etc. [ATTACH type="full" alt="1714083549623.png"]283003[/ATTACH] In the home environment, all attacks could be simply mitigated by[B][COLOR=rgb(0, 168, 133)] blocking outbound connections of PowerShell (Command and Control stage)[/COLOR][/B]. Of course, such a simple mitigation is not sufficient for many other fileless techniques. [/QUOTE]

Verification