Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 841986" data-attributes="member: 83059">This is a really good point. Heuristic analysis is still a great way to protect against zero days. Note that some AV&#039;s like Norton&#039;s engine do also invest in heuristics (see their Heur.AdvML.x detections, <a href="https://www.symantec.com/security-center/writeup/2016-051811-2400-99" target="_blank">Heur.AdvML.B | Symantec</a>). And F-Secure&#039;s DeepGuard also contains some set of heuristic signatures (ironically often times when I execute zero days I find, it is DeepGuard that catches it before the payload even gets to executing, indicating it&#039;s static analysis and not runtime behavior blocking based)The nice thing about static analysis heuristics and generics is that you don&#039;t risk the payload executing at all, which substantially lowers the risk of advanced malware learning how to counteract the way that behavior blockers inject themselves into the running binary.The downside I&#039;d be concerned about is FP&#039;s. Like I won&#039;t say whose engine it is, but I can compile a C program with some string constants defined like &quot;vmware-vmx.exe&quot; and &quot;vmtools&quot; and if I include 2 or 3 of those terms in the binary it will flag it as generic malware VM detection. How&#039;s the FP rate for ESET?</blockquote>

[QUOTE="MacDefender, post: 841986, member: 83059"] This is a really good point. Heuristic analysis is still a great way to protect against zero days. Note that some AV's like Norton's engine do also invest in heuristics (see their Heur.AdvML.x detections, [URL="https://www.symantec.com/security-center/writeup/2016-051811-2400-99"]Heur.AdvML.B | Symantec[/URL]). And F-Secure's DeepGuard also contains some set of heuristic signatures (ironically often times when I execute zero days I find, it is DeepGuard that catches it before the payload even gets to executing, indicating it's static analysis and not runtime behavior blocking based) The nice thing about static analysis heuristics and generics is that you don't risk the payload executing at all, which substantially lowers the risk of advanced malware learning how to counteract the way that behavior blockers inject themselves into the running binary. The downside I'd be concerned about is FP's. Like I won't say whose engine it is, but I can compile a C program with some string constants defined like "vmware-vmx.exe" and "vmtools" and if I include 2 or 3 of those terms in the binary it will flag it as generic malware VM detection. How's the FP rate for ESET? [/QUOTE]

Verification