Serious Discussion Decoding the Trend Micro Components and Protection Model

[TuxTalk]

I’ve uninstalled Trend Micro, as last night I performed a quick test again with 4-5 pieces of malware. All of them were a total miss (hypersensitive mode). Yes, Trend Micro did say “files are suspicious”, but upon second attempt to run them, there was a way to ignore this warning. When ran, all malware was actively working, without any warning from TM.

One of these files is ransomware “8base” with VT 67/74!!!

Here are the threats, all picked up by Check Point Harmony.

Spoiler: Malware not detected

View attachment 284184

This result is very much inline with all previous test results I’ve been getting from this product.

Very weird , all the malware i throw at it, instant hit n block.
Never missed any file.

Fot me this is for me something , Not being Gen Digital, Kaspersky, Eset.
I will have my trust in TM

 

[Trident]

Interesting, VT shows TM identifying 2 of the 5 hashes including the 8base ransomware as they're part of that 67/74.

Maybe they identify them after telemetry that was received when I executed them.

that "suspicious file blocked" message comes up dozen times and it comes out as being a top tier product. But had they done as you did and run anyway TM could've very well tanked.

Yes, this message is default-deny, I compiled a very simple executable and it was marked suspicious.
But I am disappointed behavioural blocking and predictive machine learning didn’t cover these threats.

 

[Mahesh Sudula]

Trend works this way. It does have good behavior monitoring modules. They somehow able to intelligently manage default-deny alongside behavior monitoring.
Any rare files (unknown, have less prevalence in TM cloud), will be blocked by default as same as how malicious files are blocked by TM.

This is the problem. We do not really understand how and why TM is blocking them. Most of the blocks are instant indicating default-deny. Logs doesn't indicate much information either.
Trend shines in the execution phase, even best (in fact total block out) once it switches to hypersensitive mode automatically. This mode is engaged automatically by TM if there are multiple suspicious file blocks back to back. AV testing scenarios fit well in this scenario and explain "its illegal" but intelligent way for such clean sheet

 

[Trident]

They call it “New Program Warning” this default deny. It is effective, but Trend displays it very often which leads to alert fatigue. At one point, this warning doesn’t mean anything to the users.

A security system that can’t take a decision but is relying on warning and prompts is not the best one.

 

[Mahesh Sudula]

A security system that can’t take a decision but is relying on warning and prompts is not the best one.

Agreed on above. I would say a balanced approach would be good bet. Like Kaspersky, G data, Bit defender. But TM is still good. I like it