Reply to thread

Message

<blockquote data-quote="MacDefender" data-source="post: 861222" data-attributes="member: 83059">It&#039;s been interesting watching [USER=78686]@SeriousHoax[/USER] run a few months of tests in the malware hub for ESET. It seems to consistently perform strongly but basically all signature based. I&#039;ve dug through the dynamic hits and it seems like they mostly fall into 2 categories:<ol>
<li data-xf-list-type="ol">Opening a network connection to a known bad destination or downloading a payload that triggers a signature </li>
<li data-xf-list-type="ol">Unpacking/deobfuscating a payload that is then picked up by signatures. </li>
</ol>That&#039;s not a bad thing, to be clear. It goes back to my takeaway point about ESET: Best signatures ever, but if it gets past signatures you are toast. Luckily most real world malware is a variant of something already known but for a true zero day I do not expect ESET to do well. Also, I am concerned that turning off network protection will result in more misses compared to a AV suite that leans on a behavior blocker component. That could be an interesting test -- take one of the dynamic hits where the network component fired, disable it, and see if another component protects you.</blockquote>

[QUOTE="MacDefender, post: 861222, member: 83059"] It's been interesting watching [USER=78686]@SeriousHoax[/USER] run a few months of tests in the malware hub for ESET. It seems to consistently perform strongly but basically all signature based. I've dug through the dynamic hits and it seems like they mostly fall into 2 categories: [LIST=1] [*]Opening a network connection to a known bad destination or downloading a payload that triggers a signature [*]Unpacking/deobfuscating a payload that is then picked up by signatures. [/LIST] That's not a bad thing, to be clear. It goes back to my takeaway point about ESET: Best signatures ever, but if it gets past signatures you are toast. Luckily most real world malware is a variant of something already known but for a true zero day I do not expect ESET to do well. Also, I am concerned that turning off network protection will result in more misses compared to a AV suite that leans on a behavior blocker component. That could be an interesting test -- take one of the dynamic hits where the network component fired, disable it, and see if another component protects you. [/QUOTE]

Verification