Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Inactive Support Threads
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Reply to thread
Menu
Install the app
Install
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Security
General Security Discussions
Do we actually need so many security programs?
Message
<blockquote data-quote="Andy Ful" data-source="post: 775136" data-attributes="member: 32260"><p><strong>Test continuation with script trojan-downloaders.</strong></p><p>The testing scripts adopted 7 different methods of downloading files and 8 different methods of executing files from scripts. I used VBScript and PowerShell.</p><p>The test was done on Windows 8 in a VM, because on Windows 10 I use ShadowDefender, which is incompatible with F-Secure Safe.. If I correctly remember, F-Secure Safe has not yet adopted AMSI, so the result for Windows 10 should be the same.</p><p></p><p><span style="font-size: 18px"><span style="color: rgb(0, 168, 133)"><strong>F-Secure Safe</strong> </span></span></p><ol> <li data-xf-list-type="ol">Only one PowerShell sample was blocked by DeepGuard. The System.Net.WebClient class was blocked and could not download the payload. The rest of PowerShell methods were not blocked either by DeepGuard nor by the static detection. The static detection of PowerShell samples was slightly worse as compared to BitDefender. It seems that BitDefender uses a different heuristics.</li> <li data-xf-list-type="ol">Yet, when the same code was transferred to VBScript which ran PowerShell, then DeepGuard did not detect System.Net.WebClient, and the payload was successfully executed.</li> <li data-xf-list-type="ol">The 50% of VBScript samples were blocked by static detection (similar detection as for BitDefender). No DeepGuard detection for VBScript, at all. Next, I turned off the real-time AV scanning, and left DeepGuard active, but the result did not change - only the sample from point 1. was blocked.</li> </ol><p>I am curious why the static detection of PowerShell samples was different as compared to Bitdefender. Maybe it was adjusted to work with DeepGuard? Is heuristic detection related to DeepGuard?</p><p>Anyway, DeepGuard is not effective for blocking script trojan downloaders.</p></blockquote><p></p>
[QUOTE="Andy Ful, post: 775136, member: 32260"] [B]Test continuation with script trojan-downloaders.[/B] The testing scripts adopted 7 different methods of downloading files and 8 different methods of executing files from scripts. I used VBScript and PowerShell. The test was done on Windows 8 in a VM, because on Windows 10 I use ShadowDefender, which is incompatible with F-Secure Safe.. If I correctly remember, F-Secure Safe has not yet adopted AMSI, so the result for Windows 10 should be the same. [SIZE=18px][COLOR=rgb(0, 168, 133)][B]F-Secure Safe[/B] [/COLOR][/SIZE] [LIST=1] [*]Only one PowerShell sample was blocked by DeepGuard. The System.Net.WebClient class was blocked and could not download the payload. The rest of PowerShell methods were not blocked either by DeepGuard nor by the static detection. The static detection of PowerShell samples was slightly worse as compared to BitDefender. It seems that BitDefender uses a different heuristics. [*]Yet, when the same code was transferred to VBScript which ran PowerShell, then DeepGuard did not detect System.Net.WebClient, and the payload was successfully executed. [*]The 50% of VBScript samples were blocked by static detection (similar detection as for BitDefender). No DeepGuard detection for VBScript, at all. Next, I turned off the real-time AV scanning, and left DeepGuard active, but the result did not change - only the sample from point 1. was blocked. [/LIST] I am curious why the static detection of PowerShell samples was different as compared to Bitdefender. Maybe it was adjusted to work with DeepGuard? Is heuristic detection related to DeepGuard? Anyway, DeepGuard is not effective for blocking script trojan downloaders. [/QUOTE]
Insert quotes…
Verification
Post reply
Top
