Reply to thread

Message

<blockquote data-quote="SeriousHoax" data-source="post: 1120683" data-attributes="member: 78686">I don&#039;t think so unless something changed lately <img class="smilie smilie--emoji" loading="lazy" alt="🤔" title="Thinking face&nbsp; &nbsp; :thinking:" src="https://cdn.jsdelivr.net/joypixels/assets/6.6/png/unicode/64/1f914.png" data-shortname=":thinking:" /> It doesn&#039;t match with my own tests. Early last year, I found malwares for which BDTS&#039;s memory scanning was triggered shortly after running a malware.I ran the same sample in BD Free and the detection occurred at a later stage by BD&#039;s behavior blocker ATC, not by memory scanning as it doesn&#039;t have it.The scan script option in BD is AMSI. BD already has their own script emulation engine so it can scan scripts without AMSI, but AMSI was added later as an additional layer.I verified in BD Free that it indeed does not have AMSI. It&#039;s easy to check using Process Explorer. In BDTS, BD&#039;s own amsi dll named, &quot;antimalware_provider64.dll&quot; is injected into powershell.exe but it wasn&#039;t in BD Free.</blockquote>

[QUOTE="SeriousHoax, post: 1120683, member: 78686"] I don't think so unless something changed lately 🤔 It doesn't match with my own tests. Early last year, I found malwares for which BDTS's memory scanning was triggered shortly after running a malware. I ran the same sample in BD Free and the detection occurred at a later stage by BD's behavior blocker ATC, not by memory scanning as it doesn't have it. The scan script option in BD is AMSI. BD already has their own script emulation engine so it can scan scripts without AMSI, but AMSI was added later as an additional layer. I verified in BD Free that it indeed does not have AMSI. It's easy to check using Process Explorer. In BDTS, BD's own amsi dll named, "antimalware_provider64.dll" is injected into powershell.exe but it wasn't in BD Free. [/QUOTE]

Verification