Reply to thread

Message: <blockquote data-quote="Andy Ful" data-source="post: 1014412" data-attributes="member: 32260">I think that malware will be half-invisible because it can be still detected by behavior. By a simple modification, it can be also half invisible against other AVs by auto-deleting the initial sample (often done by info stealers). Of course, this is not required when the malware has been prepared against the concrete AV (Microsoft Defender).Still, allowing AV exclusions for any process running with high privileges is not a good idea (see my next post). This can be very useful for administrators in Enterprises, but unnecessary at home.</blockquote>

Top