Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 918016" data-attributes="member: 83059">Yeah custom HIPS rules are a really neat feature but in my opinion it&#039;s best for enterprise hardening of services that get deployed across an enterprise environment. It&#039;s akin to writing your own AppArmor/SELinux sandboxing rules for pretty much every possible attack vector and since the &quot;Smart&quot; setting in ESET preprograms almost nothing (except for maybe a few isolated ransomware vectors they can&#039;t write signatures for), IMO this is an unreasonable demand of home users. [USER=78686]@SeriousHoax[/USER] has a good example of how to implement CFA / protected folders using the HIPS which will give you some ideas of how to use it, but I still think even with that example, maintaining all the exceptions to that is a ton of work, and frankly something I expect the AV company to be doing for me.BTW, in terms of bypassing ESET, my experience this summer has been that it takes me about 1-2 hours to construct a bypass of just about every AV software I&#039;ve personally tested, as long as you start with the assumption that the user will download and execute your payload. (I&#039;m saying that to express how easy it is to bypass a specific AV, not that I&#039;m qualified to be a malware writer). I struggle to find a way to scientifically assess which AV does better, because most often you&#039;ll find that one technique works against 4 AVs but a 5th one catches it, and if you tweak the exploit for the 5th AV to miss it, the other AV&#039;s start catching it. It&#039;s hard to turn that into a ranking of who I think does the best. While I find home-brew malware simulation to be a really interesting technique that teaches us a lot about how each AV&#039;s protection works, I don&#039;t know if that&#039;s what I&#039;d use to rank AVs overall.</blockquote>

[QUOTE="MacDefender, post: 918016, member: 83059"] Yeah custom HIPS rules are a really neat feature but in my opinion it's best for enterprise hardening of services that get deployed across an enterprise environment. It's akin to writing your own AppArmor/SELinux sandboxing rules for pretty much every possible attack vector and since the "Smart" setting in ESET preprograms almost nothing (except for maybe a few isolated ransomware vectors they can't write signatures for), IMO this is an unreasonable demand of home users. [USER=78686]@SeriousHoax[/USER] has a good example of how to implement CFA / protected folders using the HIPS which will give you some ideas of how to use it, but I still think even with that example, maintaining all the exceptions to that is a ton of work, and frankly something I expect the AV company to be doing for me. BTW, in terms of bypassing ESET, my experience this summer has been that it takes me about 1-2 hours to construct a bypass of just about every AV software I've personally tested, as long as you start with the assumption that the user will download and execute your payload. (I'm saying that to express how easy it is to bypass a specific AV, not that I'm qualified to be a malware writer). I struggle to find a way to scientifically assess which AV does better, because most often you'll find that one technique works against 4 AVs but a 5th one catches it, and if you tweak the exploit for the 5th AV to miss it, the other AV's start catching it. It's hard to turn that into a ranking of who I think does the best. While I find home-brew malware simulation to be a really interesting technique that teaches us a lot about how each AV's protection works, I don't know if that's what I'd use to rank AVs overall. [/QUOTE]

Verification