Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 844141" data-attributes="member: 83059">Yeah to be clear I expect that an actual in the wild variant of an existing form of ransomware will probably get caught by ESET. Their static scanner is excellent at finding variants of things they have signatures for.My testing here is just on the scope of a true zero-day, something that nobody would have signatures for since I made the executable 5 minutes ago as if I were a for-hire malware writer to target an individual. It&#039;s purely meant as a behavior blocker test for antimalware solutions that claim to have a behavior blocker component. I&#039;m not even going to claim that AV&#039;s that ace this test provide better protection -- I don&#039;t know enough to say that. Just as a software engineer, behavior blockers are particularly interesting to me as a test target since it&#039;s relatively simple to whip up a program that pretends to do something bad.</blockquote>

[QUOTE="MacDefender, post: 844141, member: 83059"] Yeah to be clear I expect that an actual in the wild [I]variant of an existing form of ransomware [/I]will probably get caught by ESET. Their static scanner is excellent at finding variants of things they have signatures for. My testing here is just on the scope of a true zero-day, something that nobody would have signatures for since I made the executable 5 minutes ago as if I were a for-hire malware writer to target an individual. It's purely meant as a behavior blocker test for antimalware solutions that claim to have a behavior blocker component. I'm not even going to claim that AV's that ace this test provide better protection -- I don't know enough to say that. Just as a software engineer, behavior blockers are particularly interesting to me as a test target since it's relatively simple to whip up a program that pretends to do something bad. [/QUOTE]

Verification