Reply to thread

Message

<blockquote data-quote="509322" data-source="post: 774709">I don&#039;t know why people are surprised by this.Kaspersky is using signatures to detect malicious scripts just the same as Bitdefender.Both Bitdefender and Kaspersky claim AMSI integration.The thing about AMSI integration is that the vendor usually can&#039;t get it right because Microsoft is obviously withholding much of the AMSI documentation\nitty-gritty. Nothing new there.Just goes to show that AMSI isn&#039;t that great. However, in my testings, both Bitdefender and Kaspersky essentially performed the same. However, my testings were focused upon in-memory attacks. I don&#039;t understand the tunnel-vision focus upon on-disk scripts. That focus is noobish.Rules based protections will fail people.Default-allow will fail people.At least Kaspersky has all the makings of SRP right there in Application Control and TAM. It&#039;s up to the user to make it real default-deny.</blockquote>

[QUOTE="509322, post: 774709"] I don't know why people are surprised by this. Kaspersky is using signatures to detect malicious scripts just the same as Bitdefender. Both Bitdefender and Kaspersky claim AMSI integration. The thing about AMSI integration is that the vendor usually can't get it right because Microsoft is obviously withholding much of the AMSI documentation\nitty-gritty. Nothing new there. Just goes to show that AMSI isn't that great. However, in my testings, both Bitdefender and Kaspersky essentially performed the same. However, my testings were focused upon in-memory attacks. I don't understand the tunnel-vision focus upon on-disk scripts. That focus is noobish. Rules based protections will fail people. Default-allow will fail people. At least Kaspersky has all the makings of SRP right there in Application Control and TAM. It's up to the user to make it real default-deny. [/QUOTE]

Verification